spynote | 32098a3eef8873548d1de96df13d1c9da40fa6be788efd8dedd9658cd9325240

General

Target
youtube.lite_Dropper.apk
Size 7.3MB
Sample260612-xdm2wabv2w
SHA256 32098a3eef8873548d1de96df13d1c9da40fa6be788efd8dedd9658cd9325240
MD5 e329dacf468ea39bc42569f942cb9b9c
SHA1 725bf9d7ffbfb6dc37c70667508be93c54dff2c5
SHA512 1fa3a78097b8d513cf19e8414c192bb7c4766abc02adcd91c19178e150a0be72865ac477b8efe101b326ea9855bcc1a907ed766ca9c74e62fb47c7c2a48601a1
SSDEEP 196608:exIX9YVvJBY4gwpiX6ol2u379oFMSWRk/GP78TJ:dX9khBYj8iX6tnpk78V
TLSH
T11B762252FB06D82AC4E7C3374A3A46756A069C1D8693C78769D8723C4DBF9C04EDAEC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  youtube.lite_Dropper.apk
- Size 7.3MB
- SHA256 32098a3eef8873548d1de96df13d1c9da40fa6be788efd8dedd9658cd9325240
- MD5 e329dacf468ea39bc42569f942cb9b9c
- SHA1 725bf9d7ffbfb6dc37c70667508be93c54dff2c5
- SHA512 1fa3a78097b8d513cf19e8414c192bb7c4766abc02adcd91c19178e150a0be72865ac477b8efe101b326ea9855bcc1a907ed766ca9c74e62fb47c7c2a48601a1
- SSDEEP 196608:exIX9YVvJBY4gwpiX6ol2u379oFMSWRk/GP78TJ:dX9khBYj8iX6tnpk78V
- TLSH
  T11B762252FB06D82AC4E7C3374A3A46756A069C1D8693C78769D8723C4DBF9C04EDAEC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

persistence
behavioral1 behavioral2 behavioral3
- Target
  childapp.apk
- Size 4.4MB
- SHA256 d040ea6f737946babeaa20ec92e1bd8bf0b342f37019188426e5222597052d45
- MD5 5fca3c4f8ec383fed2ba56ce29b39c83
- SHA1 3f93ba867fba78f862876f9802109de9f043eae9
- SHA512 3c0b5904ec2b9e3c62368d76635331dd19a0d6ff838177257977591c5e4222a0eb6d266f090136d4a083863801638573ca2c3cfb4e949a60f4a0864084cea3c3
- SSDEEP 98304:XFLjWIJ1lFrDVxC/W/FYMqes8/L88mz4zBpTN0t4k1qN:oIvlsKZHL4zuCfq
- TLSH
  T1A226F103FB45CB97D8AA83F66F370DA92A134F14C6436AE70955762E2E772C10EC568C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection credential_access defense_evasion discovery evasion execution persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral4 behavioral5 behavioral6