spynote | 13329545589[.]zip

Resubmissions

10/12/2023, 02:19

231210-csbxyadbb310

06/12/2023, 10:45

231206-mtfydsdg9710

Sharing

Copy URL Twitter E-mail

General

Target
13329545589.zip
Size 668KB
Sample231210-csbxyadbb3
SHA256 51b03b7d31c6834d57874e01754838e7656874f6283009243add2c6ceb5262c3
MD5 c61aa88cc5f9b9ba0bd66545cc4b9099
SHA1 12a1406f355407a2ff1708a346e76d055cf52217
SHA512 029a34564f1588e0bb9c20c1bbb18eabf8e49a2290b80286471b4a36a500ea1fac5d6864ad50d9c17c355a1d6ddf386b7ae3957e25deaebd40816cca68d5cd13
SSDEEP 12288:d99PXEAreA2F7Z0MwB19nqXe/BupvhRZIcXzJ+AA3je3bFOEzld6fgJwvLL:dQAreAKKzQOahR+yF+HGYEzldcgOjL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

20.118.161.39:9292

Signatures

Spynote family
spynote

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

File Explorer

13329545589.zip

.zip 668KB
c73fe025e9768d08b85840a99d100d44ef948175f233c162ea70391bd8f6dac4

.apk 4.1MB

13329545589.zip

SHA256 51b03b7d31c6834d57874e01754838e7656874f6283009243add2c6ceb5262c3
MD5 c61aa88cc5f9b9ba0bd66545cc4b9099
SHA1 12a1406f355407a2ff1708a346e76d055cf52217
SHA512 029a34564f1588e0bb9c20c1bbb18eabf8e49a2290b80286471b4a36a500ea1fac5d6864ad50d9c17c355a1d6ddf386b7ae3957e25deaebd40816cca68d5cd13
SSDEEP 12288:d99PXEAreA2F7Z0MwB19nqXe/BupvhRZIcXzJ+AA3je3bFOEzld6fgJwvLL:dQAreAKKzQOahR+yF+HGYEzldcgOjL
MD5 SHA1 SHA512 SSDEEP

Password

infected

c73fe025e9768d08b85840a99d100d44ef948175f233c162ea70391bd8f6dac4

SHA256 c73fe025e9768d08b85840a99d100d44ef948175f233c162ea70391bd8f6dac4
MD5 96917d0e934c618c5aabab7c4e53f906
SHA1 3837723786bb37bebc56e591c98f3af0f47ec1b1
SHA512 55a98b9adaf6b91f66291b9df2ccd130844c5b67230ca8b85cabcd483616f2ea89d91d008f4ade6821340d26c427050e42e36ec9181f460da9430442a19bd5bf
SSDEEP 12288:ckv7fGlsJ4nk6Ywq+LCHR7iBU5txJQnZi+CXYbCQ704JaJbiWpoN4ed/d6O:7v7fGlu6Tqt48KE+CXYbCQRJqbibN5Fp
MD5 SHA1 SHA512 SSDEEP

android

Password

infected

asbestos.refurbished.treatments

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.wprknhnjıugotebhdzqcrvvwngxdwrivatklfkhobzeqtkxsky31

android.intent.action.CHOOSER android.intent.action.MAIN android.intent.action.VIEW android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_CHANGED com.ui.OnAlarmReceiver.ACTION_WIDGET_RECEIVER com.android.vending.billing.InAppBillingService.COIN com.android.vending.billing.InAppBillingService.COIO com.android.vending.billing.InAppBillingService.LUCM com.android.vending.billing.InAppBillingService.PROX ir.cafebazaar.pardakht.InAppBillingService.BIND ru.aaaaaaax.installer com.nokia.payment.iapenabler.InAppBillingService.BIND com.android.vending.billing.InAppBillingService.INST

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.cwrczjkzglyfaylkecvlvibrtazwfjvlrtfjwlmrjbuuvqwbyj20

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.lmhaujfahhqkjhdolgjrfcncvlsıhtlyafsaınfxazrxsheweu25

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.uezlgdtzcdibftudrlvvgjgvnxfelfxbqınubehzdmdwvwpgzt4.dbqqcqebwmempfkewrcmcfxtlxqnbvlgeqatıbimhugmqbwxou70_WBV

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.lhyyepkwfesflalotıhzgakızhbsxnjsfknhakfamfusdmqrsq14_CA

asbestos.refurbished.treatments.xyz

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.dbqqcqebwmempfkewrcmcfxtlxqnbvlgeqatıbimhugmqbwxou72_SCA

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.lhyyepkwfesflalotıhzgakızhbsxnjsfknhakfamfusdmqrsq14

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.lhyyepkwfesflalotıhzgakızhbsxnjsfknhakfamfusdmqrsq14_WKUP

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2._ask_remove_

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.cwrczjkzglyfaylkecvlvibrtazwfjvlrtfjwlmrjbuuvqwbyj20instll

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.flyactiv

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.cqiwvnoqrhdpffumpxtwuonfosobvenqzmalnaaocbgjixpwsu22

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.Retvofdjzfdhpwsmusjdocgybmrfkpimgvdmapjubiaciwgcgdcy26UI

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.utnacrthomaajnoieeracgsynamtkatzrbpaıiomdhzfdfxpxo29

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.utnacrthomaajnoieeracgsynamtkatzrbpaıiomdhzfdfxpxo29V2

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.utnacrthomaajnoieeracgsynamtkatzrbpaıiomdhzfdfxpxo29kb

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.geuscsvaiyjntwpnnfscnrpdatnfuddwwvcrrxrnnucnhugxfı21

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.lhyyepkwfesflalotıhzgakızhbsxnjsfknhakfamfusdmqrsq14_AA

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.ysdcbkxdxiyoovfhjvezcncurtgjyqhyeqgewohdvwgybnygqn5.SRdbqqcqebwmempfkewrcmcfxtlxqnbvlgeqatıbimhugmqbwxou74B

asbestos.refurbished.treatments.RestartSensor

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.ysdcbkxdxiyoovfhjvezcncurtgjyqhyeqgewohdvwgybnygqn5.dbqqcqebwmempfkewrcmcfxtlxqnbvlgeqatıbimhugmqbwxou7

android.intent.action.BOOT_COMPLETED android.intent.action.ACTION_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.LOCKED_BOOT_COMPLETED miui.intent.action.BOOT_COMPLETEDT

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.ysdcbkxdxiyoovfhjvezcncurtgjyqhyeqgewohdvwgybnygqn5.lhyyepkwfesflalotıhzgakızhbsxnjsfknhakfamfusdmqrsq14_RC

android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_CHANGED

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.ysdcbkxdxiyoovfhjvezcncurtgjyqhyeqgewohdvwgybnygqn5.dbqqcqebwmempfkewrcmcfxtlxqnbvlgeqatıbimhugmqbwxou74

android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.USER_PRESENT

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.ysdcbkxdxiyoovfhjvezcncurtgjyqhyeqgewohdvwgybnygqn5.daterec

android.intent.action.DATE_CHANGED

asbestos.refurbished.mxsyjfypqkpuspdlkolxjbfuvnapppqvfjopsepcafaqcknaya2.ysdcbkxdxiyoovfhjvezcncurtgjyqhyeqgewohdvwgybnygqn5.dbqqcqebwmempfkewrcmcfxtlxqnbvlgeqatıbimhugmqbwxou7_AR

android.app.action.DEVICE_ADMIN_ENABLED