spynote | 348b84d12e8ec9d84a2cc48f0050782aafdd6d4e980ea3f9faea485bd7709f0f

General

Target
standoff 2.apk
Size 760KB
Sample260715-2rf8psax61
SHA256 348b84d12e8ec9d84a2cc48f0050782aafdd6d4e980ea3f9faea485bd7709f0f
MD5 5d037ea43c358e57b91ee6d838f9b874
SHA1 abd9f15a8ca621d1f98ac59eea0a6c5549e5ea1d
SHA512 b537caf4d408f777481fee1e263ccb2480db99bb1aed5f3580c31493d7da7ae99053feafe56cdee08055f600ebd47bad7efb0cbafcbb570d3913a0aadaa18f93
SSDEEP 12288:75wTa1a8Lre3pNtyzNwZk5WmpYshXZPbGwidNpgJNEc:7oa1a2e3pKzNwZk5WmD9idNpW2c
TLSH
T169F45CC6FB49F867C9F7C6398375C66A9A064C654B43D7831985723C0AB7AC08B85FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

spynote

C2

61qusahrad.localto.net:7642

Targets

- Target
  standoff 2.apk
- Size 760KB
- SHA256 348b84d12e8ec9d84a2cc48f0050782aafdd6d4e980ea3f9faea485bd7709f0f
- MD5 5d037ea43c358e57b91ee6d838f9b874
- SHA1 abd9f15a8ca621d1f98ac59eea0a6c5549e5ea1d
- SHA512 b537caf4d408f777481fee1e263ccb2480db99bb1aed5f3580c31493d7da7ae99053feafe56cdee08055f600ebd47bad7efb0cbafcbb570d3913a0aadaa18f93
- SSDEEP 12288:75wTa1a8Lre3pNtyzNwZk5WmpYshXZPbGwidNpgJNEc:7oa1a2e3pKzNwZk5WmD9idNpW2c
- TLSH
  T169F45CC6FB49F867C9F7C6398375C66A9A064C654B43D7831985723C0AB7AC08B85FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker defense_evasion discovery persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Requests enabling of the accessibility settings.
behavioral1 behavioral2

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2