General
- Target ready.apk
- Size 8.5MB
- Sample261105-sgesfs1vdv
- SHA256 a103e1d955b9d5d9a20acfcfebb0d516f8b4dc5890d7c4b7d3789bc937a6ac38
- MD5 0144e739301a5e72eea7e5dc9fb06f9f
- SHA1 e6b2b9b46ad903e54136a56576fd6c9cd29e8c85
- SHA512 8cbc4d9e77572ee6c132ed0aaf239ca34aa4c3a8dc86169cf067dceb5519aff4ec8080879548e02f04445ab25bdc66e39a2c42254e16e7bf58f803be0a45ffb9
- SSDEEP 49152:a5JLcc/JRAMntjpG4vuXq7XBlg9OU6hNndusTzRXX9VmzEzdGGwQTOn3UhYq20c+:6LccxSyYXrV63FzRXXnmzEzBnTI0t5R
- TLSH T17E96F143F916CB87C42D92F42E170FA82E272F5896912AEB14543A5F3F7A2D20DD65CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-33-x64-arm64-20260708-en
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
ready.apk
Resource
android-35-x64-arm64-20260325-en
6 signatures
900 seconds
Malware Config
Targets
-
- Target ready.apk
- Size 8.5MB
- SHA256 a103e1d955b9d5d9a20acfcfebb0d516f8b4dc5890d7c4b7d3789bc937a6ac38
- MD5 0144e739301a5e72eea7e5dc9fb06f9f
- SHA1 e6b2b9b46ad903e54136a56576fd6c9cd29e8c85
- SHA512 8cbc4d9e77572ee6c132ed0aaf239ca34aa4c3a8dc86169cf067dceb5519aff4ec8080879548e02f04445ab25bdc66e39a2c42254e16e7bf58f803be0a45ffb9
- SSDEEP 49152:a5JLcc/JRAMntjpG4vuXq7XBlg9OU6hNndusTzRXX9VmzEzdGGwQTOn3UhYq20c+:6LccxSyYXrV63FzRXXnmzEzBnTI0t5R
- TLSH T17E96F143F916CB87C42D92F42E170FA82E272F5896912AEB14543A5F3F7A2D20DD65CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Requests enabling of the accessibility settings.
MITRE ATT&CK Mobile v16
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Obfuscated Files or Information
1Tasks
static1
bankertrojaninfostealerratspynote
Score
10/10
behavioral1
bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionspynoteinfostealerpersistencerattrojan
Score
10/10
behavioral2
bankercollectioncredential_accessdefense_evasiondiscoveryexecutionspynoteinfostealerpersistencerattrojan
Score
10/10