spynote | d0c34a43a01f24ae3414a9fb9de7bdfd49264b38310051785d338a9f3aaeaa96

General

Target

Interbank.Seguridad.apk
Size

8.6MB
Sample

250402-s1fh4askx4
MD5

f12334c49f47b7442943dcec85d4d5cc
SHA1

6e551d2d701bb79834b0a915495f01885f7acda8
SHA256

d0c34a43a01f24ae3414a9fb9de7bdfd49264b38310051785d338a9f3aaeaa96
SHA512

f344cefbccbe71f6b22cabe0a86b5423c50cd21b59f97aac23c402222e5484693db6f8fdf148c8451e7beef2e5f9402bb2de656e8d2c47de8b96ded5deb68ebb
SSDEEP

196608:M6SqyptZDn7x85hF6bhoBJeVlPLypPugBRfNmLLx:TSqyp3DV85hkhoB4NERBRK

Score

10^/10

Malware Config

Targets

- Target
  
  Interbank.Seguridad.apk
- Size
  
  8.6MB
- MD5
  
  f12334c49f47b7442943dcec85d4d5cc
- SHA1
  
  6e551d2d701bb79834b0a915495f01885f7acda8
- SHA256
  
  d0c34a43a01f24ae3414a9fb9de7bdfd49264b38310051785d338a9f3aaeaa96
- SHA512
  
  f344cefbccbe71f6b22cabe0a86b5423c50cd21b59f97aac23c402222e5484693db6f8fdf148c8451e7beef2e5f9402bb2de656e8d2c47de8b96ded5deb68ebb
- SSDEEP
  
  196608:M6SqyptZDn7x85hF6bhoBJeVlPLypPugBRfNmLLx:TSqyp3DV85hkhoB4NERBRK
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  
  childapp.apk
- Size
  
  6.4MB
- MD5
  
  fcea28a09402071475853eb5acb391b9
- SHA1
  
  cd671e65c388487c81d9c99bf7c35edf20cb6d19
- SHA256
  
  036f8f5a182b31b29b8ab22ff38cf86b56c8d51deddfc042af1505d25c9d13b1
- SHA512
  
  83ee50cb250e793ed0abcf0f6bf224cd976bd2c2b6f5db549d495a7a837096596ef12e44a25d6038d955ce55c9d72f08c67f4b879c146909c53a3e1eb76971db
- SSDEEP
  
  98304:Ly3pzBKFmzhnsaLEwDfquY7N0mUq6ty5Ye7Zvf6LuWyc4pwoyl1PqY:LczhnsaLEcfu7/j7Z39WH19
Score

7^/10

banker collection credential_access defense_evasion discovery evasion execution persistence impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Launchs application uninstaller.
  defense_evasion impact
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Requests enabling of the accessibility settings.
behavioral4 behavioral5 behavioral6