Extracted

• • Target
    Lazada.apk
  • Size 17.5MB
  • SHA256 bf06df823a0a0b1b4618ee736f5f0bd508b315ea3c6b96a16d2a0d0e58906346
  • MD5 8ef02710098da919049cd4b68225c703
  • SHA1 2436a4b9a769c11e8ddda1bdf2ff503f461ea661
  • SHA512 c558526c100252402cb4ede061d4b1a68af97e35bb28a7f7dc57ee7e6e60add4e30e8320cee22bfefc9e499b6f935623ede7100aea5f8c86b9f657e1ad75e938
  • SSDEEP 98304:BvnmrFEc3ZigpIeVz/uI0mzRzBtTW0tylmXnKQDhG/B:lnIFPJia1FzzJdXXKMYB
  • TLSH
    T14F07F103FB45CA97D8AE83F29B370FA92E070F54C6626AE75551762D2D772D009C2ACC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3