spynote | b41da7599f8d38e0f35d1900c27139494fda4fcf55fb0fc738a378de73dc6a73

General

Target
BILLIN.apk
Size 3.8MB
Sample261106-fgplfagy2s
SHA256 b41da7599f8d38e0f35d1900c27139494fda4fcf55fb0fc738a378de73dc6a73
MD5 aec9b201f681d4f1ad42e97515f1f24a
SHA1 275bec79a4414de87918d2ec58a3695843a843f8
SHA512 ec609b0f649a54411dc4e47ad08e086eb79c3d73517c21d689dc16150f8fb1fe58fefdce107fbf1e80b8a208802051772c8bc54150f26e5d5c6febd4053eb9e6
SSDEEP 49152:r/wZ+6YhMfVeunHqsCrnULM5b4P3oWOBdxBcT8zmzwzdGGGQTOwbU/YqD0cgV4ed:ro06YiFHkHEP3AVRzmzwzBJTq0tV4T6
TLSH
T12606E103EB88CAA6D5BA83F1AF330E982E630F59C6429AE75155777D2D771C00DC5A8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BILLIN.apk
- Size 3.8MB
- SHA256 b41da7599f8d38e0f35d1900c27139494fda4fcf55fb0fc738a378de73dc6a73
- MD5 aec9b201f681d4f1ad42e97515f1f24a
- SHA1 275bec79a4414de87918d2ec58a3695843a843f8
- SHA512 ec609b0f649a54411dc4e47ad08e086eb79c3d73517c21d689dc16150f8fb1fe58fefdce107fbf1e80b8a208802051772c8bc54150f26e5d5c6febd4053eb9e6
- SSDEEP 49152:r/wZ+6YhMfVeunHqsCrnULM5b4P3oWOBdxBcT8zmzwzdGGGQTOwbU/YqD0cgV4ed:ro06YiFHkHEP3AVRzmzwzBJTq0tV4T6
- TLSH
  T12606E103EB88CAA6D5BA83F1AF330E982E630F59C6429AE75155777D2D771C00DC5A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery execution spynote infostealer persistence rat trojan evasion impact
- Family: Spynote
  Spynote is a Remote Access Trojan first seen in 2017.
  banker trojan infostealer rat spynote
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3