Extracted

• • Target
    c3jn21.apk
  • Size 5.9MB
  • SHA256 9aadd8fb01918d7ecbb9b2613d1a7551a51d69db97e51a056963adfa38b08370
  • MD5 3f0f9641b3ff9bbea02d77339f5015ef
  • SHA1 5f896e6d4fe65f9a856f2f0ec9f0b86cb2c4d087
  • SHA512 96a596c4c75960c657fbe9e11f258d98b61f336bd75df00310cf7bd51e8638e3ebf3baa762df0d950142d661614d3e609b05f1170cdff7faf3021de1975489ff
  • SSDEEP 98304:I2Rw8qYiM9DjyFDXs4gHD73eRlE+ga5e3BWzjO0qMmIXi5xgNi3Zym95r2C0yMJR:I2BBBeFcHDSDD5e3BWPO00pZ9I2w23xE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion
  behavioral1behavioral2behavioral3
• • Target
    childapp.apk
  • Size 3.8MB
  • SHA256 c90465f25b077da1b0cffa5e48730375b17ac520eed6ca0a22ae730f4fd43e12
  • MD5 dcf3d6f73814edc8a56b79b252311028
  • SHA1 1891956e8e6284bb00bc2a911069f32cb60dba8c
  • SHA512 3c992fbe5e1f5353de626993d15efbb0c3a981ef57326f5a206d7c77530a247912b87f02e8b9773b67380088c8562ac252c535250f617c84eecc4de6c39eff16
  • SSDEEP 98304:dDE5UijKdFaCWRUU5sh9l60IbcMJ/KiDyqvYimKyU:dDE6NCAI/KiDyqveKr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankerdefense_evasionevasionspynoteinfostealerpersistencerattrojancollectioncredential_accessdiscoveryexecution

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Spynote family

    spynote

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery
  behavioral4behavioral5behavioral6