Errors

Reason
could not process APK: could not decode AXML: sblock: string with idx 268435468 not found

General

  • Target

    t.apk

  • Size

    4.9MB

  • MD5

    18fbdb35e4cd08b87c4a271241a39253

  • SHA1

    a421c7228f33c3587b06c4f0600534ca2fb77aaf

  • SHA256

    e4349991ce0a2ed6e2f58e2243a6d5b3c7a795b1f6d2dcdf8817fea0e826aedc

  • SHA512

    2be43d12480851e7301922714d99e9684b074e1e9f6ecb473da2ac1c795996ac53b8b3c056055ad645d8ca5ec2f5d87df00bac49b4ad294f66e797e7ee15d7f2

  • SSDEEP

    98304:P6boJR1LlqF8oeDRUtcX+KcmWG5r5z6PS7pOks476zxMsgKk6nI+Vst8nx:ib4bDppJ5rAPSwf5gVeIAst8x

Score
10/10

Malware Config

Extracted

Family

spynote

C2

botuser0.duckdns.org:1337

Signatures

  • Spynote family
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 3 IoCs
  • Requests dangerous framework permissions 15 IoCs

Files

  • t.apk
    .apk android
  • childapp.apk
    .apk android

    com.xiaomi.service

    com.xiaomi.bikbqozbyffzozjdlqibmdezujqxgvrmbyyfevczldmefmoqww2.jqqmabnbczdavotnwubalypnzdartjceluoebkzdetudukvqfk31