General

  • Target

    temp.apk

  • Size

    1.9MB

  • MD5

    c082c76535ff78447e0f04d690b3b39c

  • SHA1

    fdadbd8f33515c2e6574f3452b8bca4a2d729852

  • SHA256

    0126bc37881a4e9c1a09977e7725d48612b4ad61db03c9769373a63ced166e55

  • SHA512

    d14df8e7af2d6170eaff2f37bf6142e11382ec83f5bd525c0c00d1ac8d5e9ef6bed588e53b6c8aae23fb6b9a62451eb8b4a146448a43a28ddbc21627bc0be00b

  • SSDEEP

    12288:EiJAXtHh4/IRWX4sZN9FPrdW3Mbo8GEvQ1k+SQZn8:ETXtHmIRGfRr9o88k+Sq8

Score
10/10

Malware Config

Extracted

Family

spynote

C2

sitedesenho.ddns.net:7771

Extracted

Family

spynote

C2

sitedesenho.ddns.net:7771

Signatures

  • Spynote family
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 2 IoCs
  • Requests dangerous framework permissions 6 IoCs

Files

  • temp.apk
    .apk android

    Password: bratsrat

    roman.landscape.template

    roman.landscape.axlnreqembqnolgqjmzefmbkdzvzjadmatsbxbjuhfaewswwdt2.whvtofkknzchzqsemgqjtztxkfwyyjmtxbovrzoefdrwnqqxmw20


Android Permissions

temp.apk

Permissions

android.permission.SEND_SMS

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.BACKGROUND_ACTIVITY_STARTER

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT