Resubmissions
02-05-2023 13:12
230502-qfls9sda5t 1002-05-2023 13:09
230502-qdy1tada4x 1002-05-2023 02:30
230502-czbwhsbc8s 10Analysis
-
max time kernel
3701665s -
max time network
12s -
platform
android_x64 -
resource
android-x64-20220823-en -
resource tags
androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system -
submitted
02-05-2023 13:12
Behavioral task
behavioral1
Sample
1.apk
Resource
android-x64-20220823-en
General
-
Target
1.apk
-
Size
1.6MB
-
MD5
ed9755072b50a930ed10c4b38509ab37
-
SHA1
a8a244dd01e61b50c6c1d7242ac0410cc6bcf8d0
-
SHA256
e10ea8a16251b4aa3d0cb471470450b856897bc064e49932d7bb5bc17fe6007b
-
SHA512
f74e6c32f7c77df6f930eba9812c23f8a0ff249d515e106719dbf043c5f7190e2d57d15b2995b5f3391d66f5ce80c43d58b76d655ddcb4cdc746d9731de1949e
-
SSDEEP
24576:TCqcDFysHAfjUIertXlgCZbphIkF49LzynEkmTDMWqIKYGaDnG5ZS9:TVcDFgSVZbLIy4pzyneeDgn4Za
Malware Config
Signatures
-
Spynote
Spynote is a Remote Access Trojan first seen in 2017.
-
Spynote payload 1 IoCs
resource yara_rule sample family_spynote -
Requests dangerous framework permissions 18 IoCs
description ioc Required to be able to access the camera device. android.permission.CAMERA Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write (but not read) the user's call log data. android.permission.WRITE_CALL_LOG Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to send SMS messages. android.permission.SEND_SMS Required to be able to access the camera device. android.permission.CAMERA Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to record audio. android.permission.RECORD_AUDIO Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to read the user's call log. android.permission.READ_CALL_LOG Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789KB
MD5185ca9f19122c0e354f04a05cecfec1d
SHA164b5a8f14c771ad5ca98338ab415ffb210813f80
SHA256204cfed93f23188a17306e98ca7fabcf1a0be6139328a524c7fa53bf57469708
SHA51254227e2fb8b9739c76c521cd2196d71ce8deff08b7ded324c553cbe413377925c0a5aeb2b800062da38a73f3b0569c4655e778ee9a6ca499aad32348da991c3c