General

  • Target

    f4039490e886c80ad068cf1637ca675fcad9e089b767179fd5c516bbf3330332

  • Size

    468KB

  • MD5

    5ab05eb1af2063caf0c581818aa43bbe

  • SHA1

    d1943c5dee87dc640350af25ca86e56a97b7c270

  • SHA256

    f4039490e886c80ad068cf1637ca675fcad9e089b767179fd5c516bbf3330332

  • SHA512

    a8e9ad1fa2c3f6458367f754f537038a09cc45b918b64f1c206e6373fbb267e4448af2f0e809c7e4d9c821c17c1981092db5d9d3af083b2cccb35d379884148e

  • SSDEEP

    12288:ITFTJgeujCVXqSAsYy0mtXL6zGG3mQrkF/QOKEcKPctg8k:ITr1kyXeyG3mQrCQOfRPQnk

Score
10/10

Malware Config

Extracted

Family

spynote

C2

4.194.25.153:5214

Signatures

  • Spynote family
  • Spynote payload 1 IoCs
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 18 IoCs

Files

  • f4039490e886c80ad068cf1637ca675fcad9e089b767179fd5c516bbf3330332
    .zip

    Password: infected

  • 3276943dafdd603863aaf4b33a6ea3569dba91b1fac81b6bb4b454ffbe99e936.apk
    .apk android

    cmf0.c3b5bm90zq.patch

    cmf0.c3b5bm90zq.patch.C7