spynote | f9c1506e4cf66a5a09eed27e3ce1bfb384796b2c7794d6e69e07679b380506d0

General

Target
ready.apk
Size 8.5MB
Sample261020-z48sdaxt9j
SHA256 f9c1506e4cf66a5a09eed27e3ce1bfb384796b2c7794d6e69e07679b380506d0
MD5 32ba4d7d66588c3a527adc0e77a694c2
SHA1 cb5b859315148beb77ecc9468484927452a98fef
SHA512 09013105a53be03be441b0c3afdb79951358320dffa170ccccc2bf0ad0f087dbd074d4fc942615b64f63ec2925414c747eacbaa430c159b1cc7bb0e2111fc636
SSDEEP 49152:DKvyqtDR/2LB+0MydpY4ztboaRyIIM7EuFjmzPzdGGQQTOvqUiYqI0cgAN0k:DKvySJ2VPM+Zb3z7NFjmzPzBHTQ0tAB
TLSH
T14896F003FA05CBC3C46C93F17A230FA91A271F4889962AEB04257B5E3E762D60DD65DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

spynote

C2

modxza7f-51032.portmap.host:51032

Targets

- Target
  ready.apk
- Size 8.5MB
- SHA256 f9c1506e4cf66a5a09eed27e3ce1bfb384796b2c7794d6e69e07679b380506d0
- MD5 32ba4d7d66588c3a527adc0e77a694c2
- SHA1 cb5b859315148beb77ecc9468484927452a98fef
- SHA512 09013105a53be03be441b0c3afdb79951358320dffa170ccccc2bf0ad0f087dbd074d4fc942615b64f63ec2925414c747eacbaa430c159b1cc7bb0e2111fc636
- SSDEEP 49152:DKvyqtDR/2LB+0MydpY4ztboaRyIIM7EuFjmzPzdGGQQTOvqUiYqI0cgAN0k:DKvySJ2VPM+Zb3z7NFjmzPzBHTQ0tAB
- TLSH
  T14896F003FA05CBC3C46C93F17A230FA91A271F4889962AEB04257B5E3E762D60DD65DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery execution spynote impact infostealer persistence rat trojan evasion privilege_escalation
- Family: Spynote
  Spynote is a Remote Access Trojan first seen in 2017.
  banker trojan infostealer rat spynote
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Tries to add a device administrator.
  privilege_escalation impact
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5