Extracted

• • Target
    Bomber.apk
  • Size 4.4MB
  • SHA256 2444f10568e478a7d34746b8c26e957dcc7eacf54ddc876505159bd4ff31d318
  • MD5 34fe6a3ad2bf1b5a6e61d87be3aadbc8
  • SHA1 4218e03f8431389790801048e06697327d51b0e1
  • SHA512 1e4a67c9342741feae2231adae4d75412af9e4d000b5cceb92eb7e5927ac6f73c0f64821ef2d4bced2f96158391269bcae09c73ff9eca1105f9e9957f2d64c84
  • SSDEEP 98304:6f7gwFnzUu3xo+sVOi3OVKgABQmzazBJTt0toOIZx:87gwF/IOg+KxvzkiBa
  • TLSH
    T12226F103FB45DB9BD8AA83F26F330DA96A131F14C64266D749553A2E2E771C10EC5A8C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral1behavioral2behavioral3
• • Target
    bomber_v8_signed.apk_Binded.apk
  • Size 6.4MB
  • SHA256 dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde
  • MD5 680a1958889a2912c2c21883b69c5dcf
  • SHA1 a7b8d87c08236d99d4d6b3b829ec4673a47d4ca2
  • SHA512 149a35b2dcd1bfd82cf79a0c41e493da2bd28eb7f0964514bf6bc0b368511bb9ef1a0fd05a75218e2df34d1db63ba82157a0994379aa06463902420682e6903d
  • SSDEEP 196608:3btaeYyie32OCJEEWAU0WtrkaQTfC91qDv:3bSyieGOCJEDZhQTLb
  • TLSH
    T1A666D056FB48A92BC4F343764D7A1223650B4C268753C7D7AD04727C28B7AD0CE9AED8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistence

  • Checks if the Android device is rooted.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Reads information about phone network operator.

    discovery

  • Checks the presence of a debugger

    defense_evasion
  behavioral4