spynote | 3442b097e1741a656b8668fd3f3f17041876969eca3913eb78934a018260de8a

General

Target
Blockchain_Dropper.apk
Size 7.3MB
Sample261012-v4mspahs7j
SHA256 3442b097e1741a656b8668fd3f3f17041876969eca3913eb78934a018260de8a
MD5 e3b18651ab2a9717d3fd6f361cfec8d5
SHA1 a229383c7d47205359f68235464e211d7aa0602a
SHA512 4d05c3702cd9bdd98daf7918eab5ee00727657752fb05f9af1ccb4a67ca895ac76be3a9d826ad0abb05fd88090dfe58bda6ceec2fe78ffbc702d781c55af9640
SSDEEP 196608:UpBYEraPGyh9elfCwG0iVpheMIDGDjtn2Q:qBYEraOyrgnG0A0MIDG12Q
TLSH
T120762352EF42D82EC4F782374936063A2A125C1D8693878B99D9B13C1CBFAD44ED6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Blockchain_Dropper.apk
- Size 7.3MB
- SHA256 3442b097e1741a656b8668fd3f3f17041876969eca3913eb78934a018260de8a
- MD5 e3b18651ab2a9717d3fd6f361cfec8d5
- SHA1 a229383c7d47205359f68235464e211d7aa0602a
- SHA512 4d05c3702cd9bdd98daf7918eab5ee00727657752fb05f9af1ccb4a67ca895ac76be3a9d826ad0abb05fd88090dfe58bda6ceec2fe78ffbc702d781c55af9640
- SSDEEP 196608:UpBYEraPGyh9elfCwG0iVpheMIDGDjtn2Q:qBYEraOyrgnG0A0MIDG12Q
- TLSH
  T120762352EF42D82EC4F782374936063A2A125C1D8693878B99D9B13C1CBFAD44ED6FD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  childapp.apk
- Size 4.4MB
- SHA256 d84b68157228f6f4c6812ed7abf459bd61ba3e7d2d434b1177ab0639cb556feb
- MD5 a82fd1bb385c2a50831d8b4d2bcdc8c8
- SHA1 c68142f3bf04cb21dd17b78c85327b1aec05aad4
- SHA512 ae13f9925d7cfe5e90f89723b401df2d91bf67f90adef710c3268ef3f9a63d122e0cf1b54c64d2b2a6ba21ddaa55e7506423525d1364080a91e76c3064782d3f
- SSDEEP 98304:9mQBKMMdOZLcliOSdumznzBBT90twueEZ:9mAwOZLcliHpzzyNv
- TLSH
  T1C6260203FB45D687D8AAC3F66F230DA91A130F25C602BBE744657A2D2D772D50DC6A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery execution spynote infostealer persistence rat trojan
- Family: Spynote
  Spynote is a Remote Access Trojan first seen in 2017.
  banker trojan infostealer rat spynote
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral2