Overview

overview

10

Static

static

10

Blockchain.apk

android-15-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Blockchain.apk
  • Size 4.4MB
  • Sample261108-a7hypats4n
  • SHA256 dc269fb42bd76f15c0bd9178077e3b5b76e7f57a6e7c1af864463a822fd3594a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
spynoteandroidbankercollectioncredential_accessdefense_evasiondiscoveryexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

  • spynote

C2

  • brag.localto.net:5689

Targets

    • Target
      Blockchain.apk
    • Size 4.4MB
    • SHA256 dc269fb42bd76f15c0bd9178077e3b5b76e7f57a6e7c1af864463a822fd3594a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankercollectioncredential_accessdefense_evasiondiscoveryexecutionspynoteimpactinfostealerpersistencerattrojan

    • Family: Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Checks Android system properties for emulator presence.

      defense_evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Acquires the wake lock

    behavioral1

MITRE ATT&CK Mobile v16

Tasks