Overview

overview

10

Static

static

6

c3jn21.apk

android-9-x86

7

c3jn21.apk

android-10-x64

7

c3jn21.apk

android-11-x64

7

childapp.apk

android-9-x86

10

childapp.apk

android-10-x64

10

childapp.apk

android-11-x64

10

Analysis

  • max time kernel
    12s
  • max time network
    160s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20250917-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250917-enlocale:en-usos:android-11-x64system
  • submitted
    04/10/2025, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    childapp.apk
  • Size 3.8MB
  • Sample251004-e7d2ysysfx
  • SHA256 c90465f25b077da1b0cffa5e48730375b17ac520eed6ca0a22ae730f4fd43e12
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bankerdefense_evasiondiscoveryevasionexecutionspynoteinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • spynote

C2

  • 151.243.219.251:5551

Signatures

  • Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote
  • Spynote family
    spynote
  • Loads dropped Dex/Jar 1 TTPs 62 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • ocean.placed.player
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4880

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dp.kotlin-v1.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v1.lua.mph
        • Size 12KB
        • SHA256 408d97e35f548015587b4fdada6c66fb82ca22591e174fa39164116d0ba6c36d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v10.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v10.lua.mph
        • Size 60KB
        • SHA256 5e3251dea213e519a92f8125b814467b76f9fbc314b25d74c9cd739d9006fa58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v11.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v11.lua.mph
        • Size 173KB
        • SHA256 da4e7db52cc6714a9964b8b3cc625e1f1df19053d5cbf0f0b89bc10608c1435f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v12.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v12.lua.mph
        • Size 77KB
        • SHA256 8b333e9ef8992fa9bcce9775328eccd92591bebb633800010a6a73cf5d931ed9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v13.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v13.lua.mph
        • Size 74KB
        • SHA256 0aca17d5b36fa80574577aa4111785a0839c0aa9eed0b7b7f7da5f75dc19905c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v14.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v14.lua.mph
        • Size 94KB
        • SHA256 3f338e0e900bf00f2e0981855fbd71e811940bdbd35f0b674039126a56787c05
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v15.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v15.lua.mph
        • Size 85KB
        • SHA256 54c3c558391e5d72c1316e69381f00c58b30150338419a7790c47a0c5559cc5a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v16.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v16.lua.mph
        • Size 36KB
        • SHA256 5e0811829dd9bda7d23213942eab175b7327535acd6398d351a5bee95998f5f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v17.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v17.lua.mph
        • Size 113KB
        • SHA256 d7f2d9545b287b40234c7873cd7a0fa6862ec79a5a6d97443356aec3a56958c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v18.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v18.lua.mph
        • Size 78KB
        • SHA256 d2ca43783b8d99accabcc2e1abc33867457c16b0a58c15278131290fdd1ecd6a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v19.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v19.lua.mph
        • Size 99KB
        • SHA256 64e68ac07faeca73e85a97ce71e958941238b1fcf5a27ff95361e4f4f80fcc05
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v2.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v2.lua.mph
        • Size 101KB
        • SHA256 c0427be6b066bd80cbae4ac6a35849efe6fd68518971d7357211e28857e7f45e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v20.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v20.lua.mph
        • Size 62KB
        • SHA256 910505c41edf3669360d708d80455fe32e69c3c8cefdee1b09b5152de6e3456f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v21.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v21.lua.mph
        • Size 75KB
        • SHA256 ab81ecacaec07cc76ae75bccb573dc3f9d8ec45381e9c01403b1dc4f329e9932
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v22.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v22.lua.mph
        • Size 105KB
        • SHA256 2a02125d196a84801acd95da097c8f62172e945f7674381add8629053a7623ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v23.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v23.lua.mph
        • Size 38KB
        • SHA256 3c5aa3550d17d98618907e33c5877dd441c43f299730632a0c9755980fee227e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v24.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v24.lua.mph
        • Size 48KB
        • SHA256 ec22a761e90d6d80ee33faf8e2afb1868125f057495882c3b843efaa4db00a89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v25.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v25.lua.mph
        • Size 57KB
        • SHA256 013bb852238e311dd8bb77b59c375b660a7378dcf6e5bb855368083034a5669a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v26.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v26.lua.mph
        • Size 90KB
        • SHA256 f70263a68254e52810973280a9999f9b99ad756aed25cac6431948761811be41
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v27.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v27.lua.mph
        • Size 99KB
        • SHA256 c12cf40148d532572b80240f252e3001a369e73deb51169a9c5c9e22e7614848
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v28.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v28.lua.mph
        • Size 554KB
        • SHA256 af4b845277b67cf1f9677a2d9349182993ca580b69a8f0fa2e25e267565a4155
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v29.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v29.lua.mph
        • Size 121KB
        • SHA256 4826ab94cc1f30aaa038bbaec5f50a6c8f1d77943e63162a7a989f7d6038364b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v3.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v3.lua.mph
        • Size 68KB
        • SHA256 017a135bfcc77dae63b7fc88dd881468a59e3d61c65914f36c77d927aee05091
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v30.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v30.lua.mph
        • Size 967KB
        • SHA256 72597ead533cc466b8ca6529398600307bb434a0fa5767ee2fede491a6f7b345
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v4.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v4.lua.mph
        • Size 149KB
        • SHA256 863f340ad19013a16b6352f26e37fa052bebe07792df2f04e94065071051d5e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v5.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v5.lua.mph
        • Size 97KB
        • SHA256 80b5447fdda611fd4f143969b5f9c80095ca9c2668823c09255b1100bc6008de
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v6.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v6.lua.mph
        • Size 95KB
        • SHA256 ebb77c73081732aa7c9786fd2ec4ad121bd05ccc1d55ac6d7728686876015d1d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v7.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v7.lua.mph
        • Size 91KB
        • SHA256 ca39f663fab00bfea35af40de549ad37aa52fccbc0dcac234a1094279d8ce550
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v8.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v8.lua.mph
        • Size 75KB
        • SHA256 4b2a549c974e82d2b5c116553b804a7294b752b67474c6ee2df56e04d01310df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dp.kotlin-v9.lua.mph
        • Path /data/user/0/ocean.placed.player/app_mph_dex/dp.kotlin-v9.lua.mph
        • Size 121KB
        • SHA256 967dd7aaa5d3b39d26e57b79215932d72b5f92d4acbf37d4778d58c0d596a753
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        meta_data0
        • Path /storage/emulated/0/AppData/meta_data0
        • Size 7KB
        • SHA256 566fb91b6bf186c05c4ec051aa2e2802961cbb158df24a8fecaa0678febece84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download