spynote | dd3b6d811ff908a8e8f08e397a0e3a81044c9d9de127ae3b46311e4d0f470ad8

General

Target
dd3b6d811ff908a8e8f08e397a0e3a81044c9d9de127ae3b46311e4d0f470ad8.apk
Size 5.4MB
Sample250715-sb2d9stnt4
SHA256 dd3b6d811ff908a8e8f08e397a0e3a81044c9d9de127ae3b46311e4d0f470ad8
MD5 0e4bfdc5da08aa39e861cc695c8f67bf
SHA1 6589a5e25465b99a6c9740f25a3656b390f34856
SHA512 1007b8f198ca203ffa8b39094559fe711c451f5889fd7c4a484b839860e56338dd2c7d77020fd9df1a7cbcbcb80ccb58f800020fdea639322435bc870a0b8991
SSDEEP 98304:lOLb3iuMXLmz2TZWorvj3wDfMICmFpUDUoDUDDTOJkLiGLCbgTknzBb0tAU:mzWdrvjgDzCmFA5ULLCb0j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spynote banker collection credential_access defense_evasion evasion execution infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

spynote

C2

178.171.122.92:13333

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote
Spynote family
spynote

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4218	lewis.pads.browsing

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/lewis.pads.browsing/app_battle/TmQ.json	4243	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/lewis.pads.browsing/app_battle/TmQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/lewis.pads.browsing/app_battle/oat/x86/TmQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/lewis.pads.browsing/app_battle/TmQ.json	4218	lewis.pads.browsing

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	lewis.pads.browsing
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	lewis.pads.browsing
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	lewis.pads.browsing

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	lewis.pads.browsing

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	lewis.pads.browsing

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	lewis.pads.browsing

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	lewis.pads.browsing

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	lewis.pads.browsing

lewis.pads.browsing
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4218
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/lewis.pads.browsing/app_battle/TmQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/lewis.pads.browsing/app_battle/oat/x86/TmQ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4243

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

1

T1541

Hide Artifacts

2

T1628

Suppress Application Icon

1

T1628.001

User Evasion

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

TmQ.json

Path /data/data/lewis.pads.browsing/app_battle/TmQ.json
Size 1.8MB
SHA256 d94f8b13526e819398b0fc8b57fbf2ddd27db301371444ae00c3ef29f9b80fa6
MD5 2e7e5d48e286e5c0f75010efcb474d49
SHA1 fffb82c88eac0f57356d863b664a3b88905decfb
SHA512 8e4b0392da07bd471a341816a188de8c33a879ce232407b270e4462609c13d379b7e86ee962e8a3e3998550aae2e8b10d12a8dd3aab82204bdf010d9159a1be2
SSDEEP 49152:WY8jNSIsrr7SrGNQoQDZOBkGoSQNSdluf:WLNWHuGNQ7DZOBklSQNSPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmQ.json

Path /data/data/lewis.pads.browsing/app_battle/TmQ.json
Size 1.8MB
SHA256 48752f3a3ddf8acf532d7f48c667006401f432949c729927e5718a0f52155ff3
MD5 b3deb0fc85840f3d6d05b432fe564b8e
SHA1 d41f77608a262bc00cc4a1ff0bd7b3fb1246115e
SHA512 49b068b68003bdf94d44e6e7f8d681f65a0decda9e14a3239affcda2f6bdbf0d705c93bab33de4f13c6c7d38a4162f97f695f7c3cc5952389ec2043e09ecf860
SSDEEP 49152:iT+eIPnhfDnOG2eSnYVVFJfn6i4zJzjsaM0TpBPCoch8YB:iSeIFOG2eSnWVn6X5o0TpBPRc1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmQ.json

Path /data/user/0/lewis.pads.browsing/app_battle/TmQ.json
Size 3.8MB
SHA256 4d17230e5a74e7b3dca8eabd9a8dcbac66d95d87885f55b11ec657419038a6c9
MD5 83b8195ee78d8ab3a3f10ace3c86fbf3
SHA1 ba840c5970fff6db8490ecb38e06c74aecf135e4
SHA512 b820b7a6ef0fba0a9aa51559ef2d85fd82250d9c301504baec68aabbc4122e666db35e692d4126ab403e1b79d73950b12bdcebc9c4657d0f787397ab64a31ba0
SSDEEP 49152:5RXAFK620NtQ4oeS0n6m/7iA4jl03pinfCTTjvgawbhYLE9q72cS2Rf9EVF4FN1e:5ROK62C8Muh
MD5 SHA1 SHA512 SSDEEP

Download

TmQ.json

Path /data/user/0/lewis.pads.browsing/app_battle/TmQ.json
Size 3.8MB
SHA256 98ad771c1fd2602bbea4c5bd084383420cf46231e8d6c5f56927f43fc8bf865e
MD5 4d3e24011d3164043f0a05fbb8b3fe18
SHA1 8f17a2edd4bfa8f9cc665520029e4c7f2cce839b
SHA512 55218ad517254e756af7d5bc6b670db1efd032fb31b72496accd861196f00f8ca60e66939c5ebdded27227843cb35196c929d6282bfda24cea65152b0e777a3b
SSDEEP 49152:5RXAFK620NtQ+oeS0n6m/7iA4jY0XpunfCTTjvgawbhYLEZqJ2IS2Rk9EVF4FN1r:5ROK62Mp1Rh
MD5 SHA1 SHA512 SSDEEP

Download

log-2025-07-15.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2025-07-15.txt
Size 292B
SHA256 048af756384168386c48965c8e991d6189021c9619ee619d929d4976baf76a2f
MD5 409af87763aad0d42985b75170eda37e
SHA1 766f7e18d1caf60e4af035875ffd650a9c136899
SHA512 f077a579be768c6a25145d33ec5923aaf6404c87a691586571d5e9d146067cf9f207621719782461502d2537e4bddbbb9cb5b1eed63f3f5e04c7626bdb8db962
MD5 SHA1 SHA512

Submit Download

log-2025-07-15.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2025-07-15.txt
Size 37B
SHA256 554b3223ef664f8db088c9fc30ab87b26836ff6a7946d4ac5f85779201de156b
MD5 9b19d7f75250f455aac6e3382f2bccc2
SHA1 ee7cc8bdcdea2f0b6955d8284371c2890338e1d5
SHA512 53621a04623f390a33276b9d2e02e4c3a909ac780972f56e526863cb148c69cf54fa21c623c530b71c747baa43263a6c2a2e0f538739bfe25a1be9b9066db407
MD5 SHA1 SHA512

Submit Download

log-2025-07-15.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2025-07-15.txt
Size 37B
SHA256 4d42977e4378a167703ef76817ebefc5dc9e124f0f78f41a84089a8735670d89
MD5 32affba0fea14fdac1490fe32084d2af
SHA1 eafc8da37db77570288b885e8211775febc8295c
SHA512 5639f06b5ad60742044988b1e3cd7f1b678d6aebff7efb8463bca4d5db7550e0d5379dd01dcdf06c75aec6d192aef8879150a2ffe132e984f89ae25a6b751381
MD5 SHA1 SHA512

Submit Download

log-2025-07-15.txt

Path /storage/emulated/0/Config/sys/apps/log/log-2025-07-15.txt
Size 25B
SHA256 2d6988fb5afdaafc4e33fa1f71d6f10c95ab5a49a8ec820add5b13eef05439af
MD5 ba30336bf53d54ed3c0ea69dd545de8c
SHA1 ce99c6724c75b93b7448e2d9fac16ca702a5711f
SHA512 eea34ca526e03349e746d3687ea660b4748f0174fe2ffdb65161e232e08630b345e03329614852ce881a71362ba68575e9dd08fa361a416e5b2fb231e21a0a3e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads