spynote | ready[.]apk

General

Target

ready.apk
Size

2.7MB
MD5

a58f1babad5e36870c747e4bbf67f233
SHA1

11d59fe6e57544e3ac16c084cc07505b4901a6d3
SHA256

0f5026f939b7fe23af7eada837ea645dd2992d7514a5b0880a1679c2a908e9ca
SHA512

15b1c2ce03d7d0ff6795d2aed671dedfed79bd27d81c0f2215af2d9f8b0e4ff0e00a676e064c764bd98627b37f8613863520a9dafa827a4cddd38b64c2cf2105
SSDEEP

49152:3bF1MIp8lMlTRaJdSIjAfZOb29BKN9dALbQ7R4ChN/3IKjK6tuvLcSYHm5mR0h:3bF7p86lNauU6ZOb290GLbdChjuvLFYg

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

C2

language-partnership.gl.at.ply.gg:19982

Signatures

Spynote family
spynote

Requests dangerous framework permissions 14 IoCs

Processes:

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

ready.apk
.apk android

mounted.travelling.struck

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ちٴᵢﹶˎﾞا诶ʿˎ工ᵢᵔ艾尺ʿلنʻʻᵎـˏ西ˎ匕ʿʾٴᵔちﾞﹶʿ丹ᴵـ下ˋᐧʾـﹶᵢˋʻʿᴵⁱᵢ20

Activities

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ちٴᵢﹶˎﾞا诶ʿˎ工ᵢᵔ艾尺ʿلنʻʻᵎـˏ西ˎ匕ʿʾٴᵔちﾞﹶʿ丹ᴵـ下ˋᐧʾـﹶᵢˋʻʿᴵⁱᵢ20

android.intent.action.VIEW

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ᵢﹳث丹ˏعˋاˎᵢلسʿ诶ˎᵎʻ比ᐧㄚᵢʿʿˆسˎיʿʼفᵎˎ诶ʿﹳقʿـٴﹶʻʿᵎ乃ﹳʿ西ˎﹳˎ14_CA

xyz

Permissions

android.permission.SEND_SMS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT

Receivers

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.SensorRestarterBroadcastReceiver

RestartSensor

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ7

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.LOCKED_BOOT_COMPLETED

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ᵢﹳث丹ˏعˋاˎᵢلسʿ诶ˎᵎʻ比ᐧㄚᵢʿʿˆسˎיʿʼفᵎˎ诶ʿﹳقʿـٴﹶʻʿᵎ乃ﹳʿ西ˎﹳˎ14_RC

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ74

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.Intent.ACTION_USER_PRESENT
android.intent.action.USER_PRESENT

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ᵔقٴ匕ﹶٴنˎˑʼـˏれٴיسˊﹶلقʾقˎ尺لʾʿ伊卄ˈʼˏˈˎ吉יـ尺ʼיخᵢٴʿﹶˋــᵎʼ33

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ7_AR

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.ACTION_PASSWORD_CHANGED
android.app.action.ACTION_PASSWORD_FAILED
android.app.action.ACTION_PASSWORD_SUCCEEDED

Services

mounted.travelling.尺سـᵎᴵﹳ尺ち匕ちىˊ哦ﹶᴵˆ伊ˑتᵢﹶ匕ﹶٴˏᐧلˏʾᴵʻٴاᵎˈ丹比ˎﹳˑˎʻˆﹳᐧفʼ丹ب艾3.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ72

android.accessibilityservice.AccessibilityService

mounted.travelling.尺سـᵎᴵﹳ尺ち匕ちىˊ哦ﹶᴵˆ伊ˑتᵢﹶ匕ﹶٴˏᐧلˏʾᴵʻٴاᵎˈ丹比ˎﹳˑˎʻˆﹳᐧفʼ丹ب艾3.SimpleIME

android.view.InputMethod

ready.apk

Permissions

android.permission.SEND_SMS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.SET_WALLPAPER

android.permission.READ_SMS

android.permission.READ_CALL_LOG

android.permission.READ_CONTACTS

android.permission.GET_ACCOUNTS

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CALL_PHONE

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Extracted

Signatures

Files

mounted.travelling.struck

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ちٴᵢﹶˎﾞا诶ʿˎ工ᵢᵔ艾尺ʿلنʻʻᵎـˏ西ˎ匕ʿʾٴᵔちﾞﹶʿ丹ᴵـ下ˋᐧʾـﹶᵢˋʻʿᴵⁱᵢ20

Activities

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ちٴᵢﹶˎﾞا诶ʿˎ工ᵢᵔ艾尺ʿلنʻʻᵎـˏ西ˎ匕ʿʾٴᵔちﾞﹶʿ丹ᴵـ下ˋᐧʾـﹶᵢˋʻʿᴵⁱᵢ20

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ᵢﹳث丹ˏعˋاˎᵢلسʿ诶ˎᵎʻ比ᐧㄚᵢʿʿˆسˎיʿʼفᵎˎ诶ʿﹳقʿـٴﹶʻʿᵎ乃ﹳʿ西ˎﹳˎ14_CA

Permissions

Receivers

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.SensorRestarterBroadcastReceiver

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ7

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ᵢﹳث丹ˏعˋاˎᵢلسʿ诶ˎᵎʻ比ᐧㄚᵢʿʿˆسˎיʿʼفᵎˎ诶ʿﹳقʿـٴﹶʻʿᵎ乃ﹳʿ西ˎﹳˎ14_RC

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ74

mounted.travelling.ˏ诶لˈ诶ʼʿﾞاʼˑ伊ʼنغᵢʾʾʾʼᵔʿ娜ㄚˎᵔˎىˏـˉٴ诶ٴ尺ٴˈʼˎʼˎˎᵢ匚ˋ下匕ى诶ا2.ᵔقٴ匕ﹶٴنˎˑʼـˏれٴיسˊﹶلقʾقˎ尺لʾʿ伊卄ˈʼˏˈˎ吉יـ尺ʼיخᵢٴʿﹶˋــᵎʼ33

mounted.travelling.ʻˑᵎᴵʼᵢᵎˆᵔ匕ʿ诶ﹶ丹ʼˋغʼˊʼﹶˋلʻᵢˈˏˉﹶᴵムˎ诶ㄚ匚匕ᴵᵔﾞٴٴفˉˉʼˎﹶلʾʾ5.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ7_AR

Services

mounted.travelling.尺سـᵎᴵﹳ尺ち匕ちىˊ哦ﹶᴵˆ伊ˑتᵢﹶ匕ﹶٴˏᐧلˏʾᴵʻٴاᵎˈ丹比ˎﹳˑˎʻˆﹳᐧفʼ丹ب艾3.ˋ弗لعちʿʻﹳˊىˑʼˏᵢ下ᵎʻˎʾ诶ˋﹳﾞ诶ىنᐧ诶ᵎـיちﹳʾˋʿـ伊عʿᵎᵎ乃ㄚʼﹶـ下ᐧⁱ72

mounted.travelling.尺سـᵎᴵﹳ尺ち匕ちىˊ哦ﹶᴵˆ伊ˑتᵢﹶ匕ﹶٴˏᐧلˏʾᴵʻٴاᵎˈ丹比ˎﹳˑˎʻˆﹳᐧفʼ丹ب艾3.SimpleIME

Android Permissions

ready.apk