Extracted

• • Target
    b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6.apk
  • Size 4.4MB
  • SHA256 b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6
  • MD5 8e408e3d592fa2bea942749408fa14c3
  • SHA1 5d39d2b7a311054d9044135d33340d66fb2642ce
  • SHA512 6fa413507aa7df9e0b3b9992855f88790d58245615031660cbb4114e26dbef57590bff2f986cbce82066ba1bf8a0cd6739213f49677a890823da96408c18b017
  • SSDEEP 98304:Z1hFXASJ2Buoty9gvNnA7kUmzLzB/TV0tICxX+:rhprJquW9vi7kTzhqpo
  • TLSH
    T10226F143FB45DA87D8AAC3F66F230D9919134F24C643AAE30461766E2E772D14DC6ACC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral1behavioral2behavioral3