spynote | effa3beba3d202a29bb80eb8c83eeef7b3395e8087aa6ea2ca7f5bfa95906bc2

General

Target
Azure Club Senior.apk
Size 7.5MB
Sample260826-dsqa1a1hrb
SHA256 effa3beba3d202a29bb80eb8c83eeef7b3395e8087aa6ea2ca7f5bfa95906bc2
MD5 90359fffe6cabe4499e782ef964c8e87
SHA1 7240506c7c2c67cca50cc709fbb110c9d69ca5a8
SHA512 6f8cec34c2148f77c6eda211337aec6f423d0f218002ac6d85d0a016b739604f9ddb6a5d7992a13b5c37acf47a2015eb1175b52e13ff1d0a1058e9631e7a7ad4
SSDEEP 98304:mo2TrI+He+2NvG0LO2cHBIf4HyDxV+E1o9IBfvNbStm6zvS59uId3RHcgdG+/WX:mo2TeF/NqHHGdvBF3R8gdr/WX
TLSH
T1DD862346FF45D86EC4E3A237493646792A159C19C2A3878B4EE8713C18BFAC44ED6FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Azure Club Senior.apk
- Size 7.5MB
- SHA256 effa3beba3d202a29bb80eb8c83eeef7b3395e8087aa6ea2ca7f5bfa95906bc2
- MD5 90359fffe6cabe4499e782ef964c8e87
- SHA1 7240506c7c2c67cca50cc709fbb110c9d69ca5a8
- SHA512 6f8cec34c2148f77c6eda211337aec6f423d0f218002ac6d85d0a016b739604f9ddb6a5d7992a13b5c37acf47a2015eb1175b52e13ff1d0a1058e9631e7a7ad4
- SSDEEP 98304:mo2TrI+He+2NvG0LO2cHBIf4HyDxV+E1o9IBfvNbStm6zvS59uId3RHcgdG+/WX:mo2TeF/NqHHGdvBF3R8gdr/WX
- TLSH
  T1DD862346FF45D86EC4E3A237493646792A159C19C2A3878B4EE8713C18BFAC44ED6FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  childapp.apk
- Size 4.6MB
- SHA256 9cc9730a4f150747fe3c34ac370e196eca2f81971de17b526d21976caec5548f
- MD5 324c5a7eb25fa2420f32de290c8ebe2e
- SHA1 386d71054655ff3ed419717fe32a3df4f07dc3e0
- SHA512 dbbc25582ca725be366ff834a8208500b83fd430061442d28143cafd0032981edebee992c2a912b73274052ce250a13c63eee25290c1d8e9e9884d588ec5366f
- SSDEEP 98304:Vc+Ff/l6DVW8HOzL0nq4IuhA9svR6KJmzHzB1TU0tc948IS:VfR/gLqthIRr8znHqES
- TLSH
  T137260203FB05DA87E8AA93F66F270CA92A130F14C7536BD70515762E2E771D10ED6A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Requests enabling of the accessibility settings.
behavioral2