Extracted

• • Target
    Blockchain.apk
  • Size 4.4MB
  • SHA256 97706d705ac7206a6e1c613ce23f6663cd3a4bf0c25bb86f920cbe69dbdb4588
  • MD5 ed89f5927fb632558a9180b39f88f6a1
  • SHA1 9f054ce052fb3af1a6218a5fd531728eafabd410
  • SHA512 d351f6da5f7680b947c14e80fa79a7aca64ffeaa94d77b9382598ce3a4198c94edae623992ad9a22fe3300d4d4096818ebac5cd5d352d76a7e13bc4f31fcd7da
  • SSDEEP 98304:47mfXBqCcnRN84Q0//LJcTsCeeL7mz+zBKTO0tITsyd:4qfX7cs4Q0XVcFuzb1wn
  • TLSH
    T19026F143FB08CB8BD8BA83F66F230DA529170F15C64366D749157A6E2E7B1C10EC5A8D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6