Extracted

• • Target
    Blockchain.apk
  • Size 4.4MB
  • SHA256 778e4ad8f8bcd6e5256692c6d793dad7af2f37e6e72e62ba7b01c43ee907d132
  • MD5 b9a6db3e9e342e0a91f042fbcbbedb4f
  • SHA1 4f44953bb62820007269df377bae8646707c2b64
  • SHA512 68f448df175147f062376646633f024f1712acda9622a0cee20e60fe5bca7008d3a11f69b9c118e5683fbd7471bdd40129330ccfe4091053e89d0288752f4ed3
  • SSDEEP 98304:r/zIntpGB8Ljt5zxWGL+YfwFQp/mz7zBlT50t8fy2I:jWt0MhJxWefcQoznWgg
  • TLSH
    T10D26F143FB44CA9BD8AAC7F66F230D692A130F15C6436AD744547A6E2E7B1C10EC5B8C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionspynoteinfostealerpersistencerattrojan

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3