Malware Analysis Report

2025-01-23 12:43

Sample ID 230225-hpglxace35
Target ready.apk
SHA256 074eae4632687caece8da8bba7dbb9de0185cc2e2349971611f3d72297626691
Tags
spynote
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

074eae4632687caece8da8bba7dbb9de0185cc2e2349971611f3d72297626691

Threat Level: Known bad

The file ready.apk was found to be: Known bad.

Malicious Activity Summary

spynote

Spynote family

Makes use of the framework's Accessibility service.

Requests dangerous framework permissions

Requests enabling of the accessibility settings.

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-02-25 06:54

Signatures

Spynote family

spynote

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-25 06:54

Reported

2023-02-25 06:55

Platform

android-x64-arm64-20220823-en

Max time kernel

2270852s

Max time network

21s

Command Line

com.printers.discovery

Signatures

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Processes

com.printers.discovery

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
NL 142.250.179.142:443 tcp
NL 142.250.179.142:443 tcp
NL 142.251.39.106:443 tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
NL 172.217.168.202:443 infinitedata-pa.googleapis.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 android.apis.google.com udp

Files

/data/user/0/com.printers.discovery/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.printers.discovery/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.printers.discovery/app_webview/webview_data.lock

MD5 ce0c2eee4f366f36a8c658de9058ad93
SHA1 c624801954dce84cf918fce756ab89efc06ad362
SHA256 695da5d6020d3fc16c382e90c0ff26dad52ed7e56a12e4f8b744ee8a54404419
SHA512 f7449a3d322c84db9a7a889fe6379f2e134d843a2d2bee739533f1d369dad7ef35acde6c424004c3553b0361bc0e867c4c83aa42140b696a2d9ef466b11a70b5

/data/user/0/com.printers.discovery/shared_prefs/WebViewChromiumPrefs.xml

MD5 97ccd9a2b2063143df56b6937f961ca4
SHA1 5e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA512 86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

/data/user/0/com.printers.discovery/app_webview/Default/Web Data

MD5 a48cd9324b1f8754b07f00d863b840f3
SHA1 11c6614775b35a58f440971dfc87c8aaac6d6173
SHA256 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA512 35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

/data/user/0/com.printers.discovery/app_webview/Default/Web Data-journal

MD5 219f09c21e5f25afd1d7a0bc5a633033
SHA1 3140fd718dcda154a961f1ed86b05087cb24359f
SHA256 57a1a77d0837107ef8e5ee7aeda9ee3ce71b25b10221e082be4bdbbcfa1d9144
SHA512 dfa16d80ee77c7e230583099f3acd6d1549a1f025717374d6df9a7b99b8490239e2c2233a8c15f43aa7454526e28b27709c32b0d85fb60595889150d7fb47557

/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.printers.discovery/app_webview/Default/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.printers.discovery/app_webview/Default/GPUCache/index-dir/temp-index

MD5 6804b210874b9d43d3f174bccd7d15be
SHA1 b86b804fc0f7d98fa68c88647f92d52699614e32
SHA256 8cceed7d8e066c9176270ef34bad6cad3911af74ca805a0ba4bf18accb934375
SHA512 d0f46054435007793a7754ad1cfbd8e079c256c2a9019dd77bffccb0999d63e8c0dfc3e6c583f5501fcda9b79053966f9021877d51d37924aabdac8d36d43b4c

/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

MD5 f9aa4b7db501317b36f34fbadea15aaa
SHA1 69ff55d2ae64c020526320ffb876c9522d9bf60e
SHA256 43a3e2da4f64117e21d5310c2d9cb2a489bdb8a835f70204d01ce0c18733d06b
SHA512 a0de41071823459e4227693e4344ca5d4ac01e4e6ae6a42589ea233fa0f528e8698bf24fb2668e8129f01bc0b1b576f00ab9d5d984ab052fbc7ceea80a75831b

/data/user/0/com.printers.discovery/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

MD5 273e369eb974405c66a998f15653844a
SHA1 0e47488b90217413cf1d66dcb5ba9251743f0292
SHA256 95f0a14510e3723185551a9d26b02b949a9cc1eb31e75a65af6e06d088f23039
SHA512 b2a1d4f6d75eeddedd9c2b947ad2454a30c3c90a24eed8850e5bab51c84e4b245597180c7b98a66fbd96bca7f229a592a64eae3b988c301b65bb8fe1050a4a4d

/data/user/0/com.printers.discovery/cache/WebView/font_unique_name_table.pb

MD5 f080fa2a56ab5479d58063e5ea871447
SHA1 4b3fd57a98916fa5784305b76ba30af26b5253d9
SHA256 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA512 8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

/data/user/0/com.printers.discovery/cache/WebView/Crashpad/settings.dat

MD5 91d231d0ed5be94442deac6b452c8448
SHA1 dee86ccf21b698e5fefafe25c9e704b0658090f2
SHA256 3cb693669fadd15252dd59206dc8af7f53cc9a093be2a0db745901ce55fe521b
SHA512 ca9e2b8922cda1e4486433a7d63cbaa365e4d6cf799661b0fc36b8c8b085c07d2968be4bef2713e82f808dcd58c4ab45651aef4aa05753ed99c899de79f34785