Extracted

• • Target
    freerobux.apk
  • Size 9.3MB
  • SHA256 ab40919f609d3fac5837a56f8473cdd3c9de9daac30203a982d52ba8e54d622f
  • MD5 01538bb4a06655c3f0df633242b15b9d
  • SHA1 0c55cd8f0614c349596623d4c93be831957dee35
  • SHA512 28bfe1a3962cf291ad7844d6f2ea31a4d9f48ef1f94433339e9f3136d0b8b01ea7cda33c31c834611e15c5973f44b5e898d9df8916d176784013c4d213208a1b
  • SSDEEP 98304:Q4z9lT2cVof40B/HdkhASvIfCeqB8nyWmzvzBrTA0tQdQH:QAkoG40B/dkhASvI3yhzNrV
  • TLSH
    T134A6F143FB46DA9BD5BA83F16B670FA92A030F18CB42AAD34550376E2D7B4C10D965CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasionevasionexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3