Analysis Overview
SHA256
074eae4632687caece8da8bba7dbb9de0185cc2e2349971611f3d72297626691
Threat Level: Known bad
The file ready.apk was found to be: Known bad.
Malicious Activity Summary
Spynote family
Makes use of the framework's Accessibility service.
Requests dangerous framework permissions
Requests enabling of the accessibility settings.
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-02-25 06:54
Signatures
Spynote family
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-25 06:54
Reported
2023-02-25 06:55
Platform
android-x64-arm64-20220823-en
Max time kernel
2270852s
Max time network
21s
Command Line
Signatures
Makes use of the framework's Accessibility service.
| Description | Indicator | Process | Target |
| Framework service call | android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId | N/A | N/A |
Requests enabling of the accessibility settings.
| Description | Indicator | Process | Target |
| Intent action | android.settings.ACCESSIBILITY_SETTINGS | N/A | N/A |
Processes
com.printers.discovery
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 142.250.179.142:443 | tcp | |
| NL | 142.250.179.142:443 | tcp | |
| NL | 142.251.39.106:443 | tcp | |
| US | 1.1.1.1:53 | infinitedata-pa.googleapis.com | udp |
| NL | 172.217.168.202:443 | infinitedata-pa.googleapis.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
Files
/data/user/0/com.printers.discovery/app_webview/variations_seed_new
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
/data/user/0/com.printers.discovery/app_webview/variations_stamp
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
/data/user/0/com.printers.discovery/app_webview/webview_data.lock
| MD5 | ce0c2eee4f366f36a8c658de9058ad93 |
| SHA1 | c624801954dce84cf918fce756ab89efc06ad362 |
| SHA256 | 695da5d6020d3fc16c382e90c0ff26dad52ed7e56a12e4f8b744ee8a54404419 |
| SHA512 | f7449a3d322c84db9a7a889fe6379f2e134d843a2d2bee739533f1d369dad7ef35acde6c424004c3553b0361bc0e867c4c83aa42140b696a2d9ef466b11a70b5 |
/data/user/0/com.printers.discovery/shared_prefs/WebViewChromiumPrefs.xml
| MD5 | 97ccd9a2b2063143df56b6937f961ca4 |
| SHA1 | 5e78a91ae5df289ce83443cb7d5589dd3504fb5d |
| SHA256 | 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd |
| SHA512 | 86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b |
/data/user/0/com.printers.discovery/app_webview/Default/Web Data
| MD5 | a48cd9324b1f8754b07f00d863b840f3 |
| SHA1 | 11c6614775b35a58f440971dfc87c8aaac6d6173 |
| SHA256 | 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420 |
| SHA512 | 35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1 |
/data/user/0/com.printers.discovery/app_webview/Default/Web Data-journal
| MD5 | 219f09c21e5f25afd1d7a0bc5a633033 |
| SHA1 | 3140fd718dcda154a961f1ed86b05087cb24359f |
| SHA256 | 57a1a77d0837107ef8e5ee7aeda9ee3ce71b25b10221e082be4bdbbcfa1d9144 |
| SHA512 | dfa16d80ee77c7e230583099f3acd6d1549a1f025717374d6df9a7b99b8490239e2c2233a8c15f43aa7454526e28b27709c32b0d85fb60595889150d7fb47557 |
/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/js/index
| MD5 | 6d7d499960179766cd4261d12dacc411 |
| SHA1 | e6f8553b0015e12b23cc551afe98763f3b1c9bed |
| SHA256 | c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182 |
| SHA512 | 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547 |
/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
| MD5 | 6d7d499960179766cd4261d12dacc411 |
| SHA1 | e6f8553b0015e12b23cc551afe98763f3b1c9bed |
| SHA256 | c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182 |
| SHA512 | 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547 |
/data/user/0/com.printers.discovery/app_webview/Default/GPUCache/index
| MD5 | 6d7d499960179766cd4261d12dacc411 |
| SHA1 | e6f8553b0015e12b23cc551afe98763f3b1c9bed |
| SHA256 | c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182 |
| SHA512 | 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547 |
/data/user/0/com.printers.discovery/app_webview/Default/GPUCache/index-dir/temp-index
| MD5 | 6804b210874b9d43d3f174bccd7d15be |
| SHA1 | b86b804fc0f7d98fa68c88647f92d52699614e32 |
| SHA256 | 8cceed7d8e066c9176270ef34bad6cad3911af74ca805a0ba4bf18accb934375 |
| SHA512 | d0f46054435007793a7754ad1cfbd8e079c256c2a9019dd77bffccb0999d63e8c0dfc3e6c583f5501fcda9b79053966f9021877d51d37924aabdac8d36d43b4c |
/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
| MD5 | f9aa4b7db501317b36f34fbadea15aaa |
| SHA1 | 69ff55d2ae64c020526320ffb876c9522d9bf60e |
| SHA256 | 43a3e2da4f64117e21d5310c2d9cb2a489bdb8a835f70204d01ce0c18733d06b |
| SHA512 | a0de41071823459e4227693e4344ca5d4ac01e4e6ae6a42589ea233fa0f528e8698bf24fb2668e8129f01bc0b1b576f00ab9d5d984ab052fbc7ceea80a75831b |
/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
| MD5 | 273e369eb974405c66a998f15653844a |
| SHA1 | 0e47488b90217413cf1d66dcb5ba9251743f0292 |
| SHA256 | 95f0a14510e3723185551a9d26b02b949a9cc1eb31e75a65af6e06d088f23039 |
| SHA512 | b2a1d4f6d75eeddedd9c2b947ad2454a30c3c90a24eed8850e5bab51c84e4b245597180c7b98a66fbd96bca7f229a592a64eae3b988c301b65bb8fe1050a4a4d |
/data/user/0/com.printers.discovery/cache/WebView/font_unique_name_table.pb
| MD5 | f080fa2a56ab5479d58063e5ea871447 |
| SHA1 | 4b3fd57a98916fa5784305b76ba30af26b5253d9 |
| SHA256 | 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815 |
| SHA512 | 8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936 |
/data/user/0/com.printers.discovery/cache/WebView/Crashpad/settings.dat
| MD5 | 91d231d0ed5be94442deac6b452c8448 |
| SHA1 | dee86ccf21b698e5fefafe25c9e704b0658090f2 |
| SHA256 | 3cb693669fadd15252dd59206dc8af7f53cc9a093be2a0db745901ce55fe521b |
| SHA512 | ca9e2b8922cda1e4486433a7d63cbaa365e4d6cf799661b0fc36b8c8b085c07d2968be4bef2713e82f808dcd58c4ab45651aef4aa05753ed99c899de79f34785 |