spyagent | 19267906361[.]zip

General

Target
19267906361.zip
Size 3.8MB
Sample241031-ek3rssxrey
SHA256 f73609d837a61d167fb03b2eeda20240957e42c6c68df1d98c93fed06f81cefa
MD5 7e5846d4e3ee5d12e83e0e187774eddb
SHA1 8019d3cf71c9816c0958dab04a785f751ab5b2e6
SHA512 8084d37a2c215283cc9cb6b0688c9a1cf047a629c55da083ed0e377b672342e8cff78d963e609b35b61f6c5d4b7d4a39c2abf772408eee4441683a6434d42ae8
SSDEEP 98304:mx8VQhqP0L9l1RKMkYjFA+w7OGuJAXXOB+1ZJMe2vrprqkN:DWhb9lbKjYjFApOXAXS+rSeSrHN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spyagent

Malware Config

Signatures

Spyagent family
spyagent

Spyagent payload 2 IoCs

resource	yara_rule
static1/unpack001/149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c	family_spyagent
static1/unpack001/149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c	family_spyagent

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION

File Explorer

19267906361.zip

.zip 3.8MB
149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c

.apk 8.5MB

19267906361.zip

SHA256 f73609d837a61d167fb03b2eeda20240957e42c6c68df1d98c93fed06f81cefa
MD5 7e5846d4e3ee5d12e83e0e187774eddb
SHA1 8019d3cf71c9816c0958dab04a785f751ab5b2e6
SHA512 8084d37a2c215283cc9cb6b0688c9a1cf047a629c55da083ed0e377b672342e8cff78d963e609b35b61f6c5d4b7d4a39c2abf772408eee4441683a6434d42ae8
SSDEEP 98304:mx8VQhqP0L9l1RKMkYjFA+w7OGuJAXXOB+1ZJMe2vrprqkN:DWhb9lbKjYjFApOXAXS+rSeSrHN
MD5 SHA1 SHA512 SSDEEP

Password

infected

149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c

SHA256 149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c
MD5 a097e2b3ec5496dd18b34c9344b5b231
SHA1 d92439fcdba8d468b2b6d64d0542c48c41b99abc
SHA512 45b400ea85aa225dfaeee7c0ad108b3d27b15ab633a003fe8d767df7162544e4a661083041e76587f79f841a36e63e59b55ef8bf3f15848d65d30d21862a83f2
SSDEEP 196608:JH6fslAGOGD+ZAeZx2S7cRrFXKe+rof8n7DLH:lwslAPTAeZxeFXWr+o
MD5 SHA1 SHA512 SSDEEP

android

Spyagent payload

com.douyin.softwareapp

19267906361.zip

149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c

com.douyin.softwareapp.MainActivity

com.douyin.softwareapp.LauncherActivity

com.douyin.softwareapp.WebSocketService

com.douyin.softwareapp.WebSocketJobService

com.douyin.softwareapp.NetworkChangeReceiver

com.douyin.softwareapp.SmsBroadcastReceiver

com.douyin.softwareapp.BootBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

19267906361.zip

149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c

com.douyin.softwareapp.MainActivity

com.douyin.softwareapp.LauncherActivity

com.douyin.softwareapp.WebSocketService

com.douyin.softwareapp.WebSocketJobService

com.douyin.softwareapp.NetworkChangeReceiver

com.douyin.softwareapp.SmsBroadcastReceiver

com.douyin.softwareapp.BootBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider