Extracted

• • Target
    pro.l²te_Dropper.apk
  • Size 5.7MB
  • SHA256 632e57b457d04f8b0e4a4fe86dfedb7395cfbc68cd9cf3ad6b3ca8bd23a17846
  • MD5 19ccde0bc052697d65a4f365fe6b6ab6
  • SHA1 1e56f8a821ce6dc652a36e0825c576b9598ce1b9
  • SHA512 5a9b880e996a3fc30bfe3230358db2ebb6f0caf1527bc87a562fe680abd6cb540b7acb94264f9925d5c1173fa67ad2a55a625e650825930a2e5210ef13770bb9
  • SSDEEP 98304:IlKBg+eSzmkra41euU7iZADDlg4E9hRhP5vBWwDdTac9tX4kFAiWg7XBIbTaaO71:IlW9UqA3lg4ELzDZ9t3N7qbTabXLx
  • TLSH
    T1175633EBA64355FBC24979734E3185A31D385CAD32B98BD2287B3D281A7D7680361CE4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    childapp.apk
  • Size 4.7MB
  • SHA256 219c7142d525c1355c41a3e8a68f14ad7fc3e3fed1df33f6c616b5207dde38c6
  • MD5 e8ee2176cdc444a670df60cd2c799f4b
  • SHA1 4e71debb5f4ed5709765e4f6fcd7633d9850feac
  • SHA512 b23825e1b7a595d7e6c79b27248a28451681e5ddd33b38a447bb09c7c67cc6359bb51d81c8e4fcb5eea90cba908430ce6d46afbcda2bbc3028aae031a3212296
  • SSDEEP 98304:Z4jV9uDX5j++EjlJyj9lWesA7vW1FxIZ5+mzOfzB3TP0tgmqKjP:Z4jTAX5j++E3u7vyxyzOFA1D
  • TLSH
    T105360103EB45DA9BD8AA83F26F330DA92A031F15C243AAD74554766E2E771C50EC5BCC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral2