Extracted

• • Target
    97936d7873348f905d119dd9399261374aae494296e1b5fb3df521ef3cc76405.apk
  • Size 4.9MB
  • SHA256 97936d7873348f905d119dd9399261374aae494296e1b5fb3df521ef3cc76405
  • MD5 15586b49f0b265d6892c48d63f0c52a1
  • SHA1 a7c67dc6a18824de9f587e10dbbf97b1f335696e
  • SHA512 309df85aaf86bad3cb4bdb1e150fb6a9bba9e70afac791524fde0f2e6da94b2d2680a82fd9127e01992e0a782c18fede851752feb6a78e6a01eedc6dc5cd9b20
  • SSDEEP 98304:pbKJrrUAtAnjU5cYoO+NamzlzBkTf0tAX4Ucbd4UcbW+lS:xDkAnjGqpNVzYQ3bcbW3
  • TLSH
    T116360203FB45CA97D8AA83F66F230DA91E170F64C642A7E34461762E2D776C14DC6ACC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  behavioral1behavioral2behavioral3