spynote | output[.]rar

Resubmissions

01/06/2024, 00:30

240601-atfleabb4x10

01/06/2024, 00:27

240601-ar15bsbg8510

Sharing

Copy URL Twitter E-mail

General

Target
output.rar
Size 2.8MB
Sample240601-atfleabb4x
SHA256 a068e05a194c1e6088a3c003d0fc7049ea148e0d6ce091a4f1456b22f96cb396
MD5 da133c66547b687674f2d27271963507
SHA1 61e4c735e2a53429a45480d0d1d8983179802ba9
SHA512 60f2bbeed3a725e48b77d5d5223e76ff6831df1176e51ffb93da9bf91ab7e797c0066b937159bc7b524eec898dfa71dcc64df774431ed9c952e78fd81a66201a
SSDEEP 49152:zN4iVIZnjzCXmfJWj1H7oz+fGgeLh++kM7vgnkd3Q3/fPJWRqIcvOh9qCR:eiaZQmfJ2JS1TkM7vld3QnPJWUIcWhkO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

Name1442-57023.portmap.host:57023

Signatures

Spynote family
spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

output.rar

.rar 2.8MB
info.inf

88B
ready.apk

.apk 8.5MB
ready.apk.idsig

77KB

output.rar

SHA256 a068e05a194c1e6088a3c003d0fc7049ea148e0d6ce091a4f1456b22f96cb396
MD5 da133c66547b687674f2d27271963507
SHA1 61e4c735e2a53429a45480d0d1d8983179802ba9
SHA512 60f2bbeed3a725e48b77d5d5223e76ff6831df1176e51ffb93da9bf91ab7e797c0066b937159bc7b524eec898dfa71dcc64df774431ed9c952e78fd81a66201a
SSDEEP 49152:zN4iVIZnjzCXmfJWj1H7oz+fGgeLh++kM7vgnkd3Q3/fPJWRqIcvOh9qCR:eiaZQmfJ2JS1TkM7vld3QnPJWUIcWhkO
MD5 SHA1 SHA512 SSDEEP

ready.apk

SHA256 6ade3f4be44a003ab964a5814e8b9ddb9c33431906383263a936382011978664
MD5 fc3a7c6b0875d53c5da601e6c2ed321e
SHA1 19b3ed756c3bc4cc5e118c15eeb9a5a764db20eb
SHA512 973c0892067f85dca9f0e6064c811f72e817beec804116f4ca528a2b6d7151a620308aff694f414e9731b28ee2736753d4ad2671bdf2a0f1f2827f553433af6a
SSDEEP 98304:clYQZdxkkZ8r5Au0EEPkMSmzjzBITu0t8o:cOQnHZ8tUhz6Vl
MD5 SHA1 SHA512 SSDEEP

android

jade.interactive.alumni

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.gxgdoykoirrrgajlndexaopdasrylphnfyjerhwvukqtcfhubk31

android.intent.action.MAIN

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.mzelaclazmcwqitvvssrdjgsalhhqtzvflasmkevyloidaasgt20

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.gktvgsqiujzuzzfeuyuehwojpjareeqimwtluottdknlxfblzf25

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.dohtfqyamjswzxiktwdqtkxdoiltyhiorcchmyasbdxnijcgok4.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw70_WBV

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.dnldmdldbhlzlotgbtytxdfpanpojgqsoeiwvlbadlgdfgnorw14_CA

jade.interactive.alumni.xyz

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw72_SCA

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.dnldmdldbhlzlotgbtytxdfpanpojgqsoeiwvlbadlgdfgnorw14

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.dnldmdldbhlzlotgbtytxdfpanpojgqsoeiwvlbadlgdfgnorw14_WKUP

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2._ask_remove_

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.mzelaclazmcwqitvvssrdjgsalhhqtzvflasmkevyloidaasgt20instll

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.installupdate

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.flyapkarnsrgighriibizzcylgroljcggaqxpvzsldyixkwmuacaw12activ

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.openawrtklaknnlghvutmejvuniswqgwfdhqpgmxihuevalfusgdyg9activity

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.opendnldmdldbhlzlotgbtytxdfpanpojgqsoeiwvlbadlgdfgnorw14chrome

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.cqfxmbdumveowoeswtxmjkmjuoyjivcvbvhiaoumyrpjjhbqiy22

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.jsbakrjmecbqyjthrybbhjcvhhtwfktyxjnhdshuwxxkkczbsd29net

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.startpsjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw7vpn

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.jsbakrjmecbqyjthrybbhjcvhhtwfktyxjnhdshuwxxkkczbsd29

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.askopawrtklaknnlghvutmejvuniswqgwfdhqpgmxihuevalfusgdyg9poact

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.jsbakrjmecbqyjthrybbhjcvhhtwfktyxjnhdshuwxxkkczbsd29V2

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.jsbakrjmecbqyjthrybbhjcvhhtwfktyxjnhdshuwxxkkczbsd29kb

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.wxrbjayqowheqyniuqjchgknucmhoqivwbcozmxpyuowmdlczf21

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.dnldmdldbhlzlotgbtytxdfpanpojgqsoeiwvlbadlgdfgnorw14_AA

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw71

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.dohtfqyamjswzxiktwdqtkxdoiltyhiorcchmyasbdxnijcgok4.apkarnsrgighriibizzcylgroljcggaqxpvzsldyixkwmuacaw12

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.yfyzircqrlnkjfrxfbhcfoeebpknhgwzqhdabfqdfvskuqkivh11

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw72

android.accessibilityservice.AccessibilityService

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.Bawrtklaknnlghvutmejvuniswqgwfdhqpgmxihuevalfusgdyg9worker

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.wjhppapvodqkcoolymqjqwohiipvcebfwpnnwaawbbyjoadtrd38

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.Vpnpsjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw71Service

android.net.VpnService

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.ghfhilqqlpoqxobavulkyltvfbrridvejbpghblgmhlfspjtwd27

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.Jobpsjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw72Service

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uifjjalfivrbngxkohdmdnecolkmchbtagesravqkfujjxwlfq3.Spghjjilbicuxkfqhtnewqnpoxnigqpchjowljilzihsfxugytr6IME

android.view.InputMethod

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uqhcgfnrbbzafsodujkwaoqzvshttwgfbuomxajoofqtatiqjg5.SRpsjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw74B

jade.interactive.alumni.RestartSensor

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uqhcgfnrbbzafsodujkwaoqzvshttwgfbuomxajoofqtatiqjg5.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw7

android.intent.action.BOOT_COMPLETED android.intent.action.ACTION_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.LOCKED_BOOT_COMPLETED miui.intent.action.BOOT_COMPLETEDT

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uqhcgfnrbbzafsodujkwaoqzvshttwgfbuomxajoofqtatiqjg5.dnldmdldbhlzlotgbtytxdfpanpojgqsoeiwvlbadlgdfgnorw14_RC

android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_CHANGED android.intent.action.MY_PACKAGE_REPLACED

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uqhcgfnrbbzafsodujkwaoqzvshttwgfbuomxajoofqtatiqjg5.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw74

android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.USER_PRESENT

jade.interactive.vfuuhmlogehuorhsdvtjmrfeixvreqpmmezkkyszmityoxypeu2.uqhcgfnrbbzafsodujkwaoqzvshttwgfbuomxajoofqtatiqjg5.datepsjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw7rec

android.intent.action.DATE_CHANGED

jade.interactive.psjytdbntzlfbkqavodzknuwdfgbutweayqwiwvmfadiwfaefw7_AR

android.app.action.DEVICE_ADMIN_ENABLED