Extracted

• • Target
    dd3b6d811ff908a8e8f08e397a0e3a81044c9d9de127ae3b46311e4d0f470ad8
  • Size 5.4MB
  • SHA256 dd3b6d811ff908a8e8f08e397a0e3a81044c9d9de127ae3b46311e4d0f470ad8
  • MD5 0e4bfdc5da08aa39e861cc695c8f67bf
  • SHA1 6589a5e25465b99a6c9740f25a3656b390f34856
  • SHA512 1007b8f198ca203ffa8b39094559fe711c451f5889fd7c4a484b839860e56338dd2c7d77020fd9df1a7cbcbcb80ccb58f800020fdea639322435bc870a0b8991
  • SSDEEP 98304:lOLb3iuMXLmz2TZWorvj3wDfMICmFpUDUoDUDDTOJkLiGLCbgTknzBb0tAU:mzWdrvjgDzCmFA5ULLCb0j
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  spynotebankercollectioncredential_accessdefense_evasionevasionexecutioninfostealerpersistencerattrojanstealth

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Spynote family

    spynote

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2