spynote | a7ff7a48c06dc4fe6e3481dc76ebfe62748e73219991681f14e378d1478d63fb

General

Target
poco.tv_Dropper.apk
Size 7.0MB
Sample260612-x98cpac17k
SHA256 a7ff7a48c06dc4fe6e3481dc76ebfe62748e73219991681f14e378d1478d63fb
MD5 720e977a79658adf1b130075fed6ce53
SHA1 00f81fbbc47a3c912f35134b194fb05bb182043c
SHA512 ca7f05149c1dd07da6e3a6b3e19145fe53dc6b99117a5c477059831b5c4366aa7334dd910a33feb7d4bde8a09536c4bb52b3e0853e66a2d4bf1a555e9b445d54
SSDEEP 196608:MABVfnyGUc0Uf/mPRJG+9Au36hBqIxFCYo5P:MCvTwW/oOSFEqIbKP
TLSH
T1AB763312BBC0B155EB9489F19D3281B00836292BE37C575131A672B52CBFF781FA26CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  poco.tv_Dropper.apk
- Size 7.0MB
- SHA256 a7ff7a48c06dc4fe6e3481dc76ebfe62748e73219991681f14e378d1478d63fb
- MD5 720e977a79658adf1b130075fed6ce53
- SHA1 00f81fbbc47a3c912f35134b194fb05bb182043c
- SHA512 ca7f05149c1dd07da6e3a6b3e19145fe53dc6b99117a5c477059831b5c4366aa7334dd910a33feb7d4bde8a09536c4bb52b3e0853e66a2d4bf1a555e9b445d54
- SSDEEP 196608:MABVfnyGUc0Uf/mPRJG+9Au36hBqIxFCYo5P:MCvTwW/oOSFEqIbKP
- TLSH
  T1AB763312BBC0B155EB9489F19D3281B00836292BE37C575131A672B52CBFF781FA26CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  childapp.apk
- Size 6.1MB
- SHA256 8eab611fd7170269d81713b40529b6f67dce10652250a4121eccca181641148d
- MD5 30ed4573d9ccfd09d023219955f5e4a5
- SHA1 05e58f26640a80430ea09cfda627ff315e6c2513
- SHA512 83375856558da23a3660735460db70e9c98b3409ed737789ab3090d8d1a212144df098b3884ec02e4048e9bb427b16fcbb2b2b3c9ebb15fd897222c6facab8ae
- SSDEEP 196608:wxNa6M46fTbd/3H1hdpg8+pzJaLEqpplwk:wmGkThbdpg8KQPpplwk
- TLSH
  T123560213EB49CAA3E86AC3F1AF230D9529071F64C6562BE715217AAD3D770D10EC1ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral2