d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
- SHA256 d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2
jqzlto.nuhkrf.uehkxv
Behavioral task
behavioral1
Sample
d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
Resource
android-x86-arm-20240624-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
Resource
android-x64-20240624-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
Resource
android-x64-arm64-20240624-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
lariska.apk
Resource
android-x86-arm-20240910-en
android-9-x86
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
lariska.apk
Resource
android-x64-20240910-en
android-10-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
lariska.apk
Resource
android-x64-arm64-20240624-en
android-11-x64
8 signatures
150 seconds
General
- Target d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
- Size 5.4MB
- Sample241111-dld96a1eql
- SHA256 d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2
- MD5 d87c5428d2ea1698309431f715227084
- SHA1 4ba458a6671ab8830f0e1cb782de386cbc5e388a
- SHA512 c24dedb312049be82be6189ee638b2b354b16796944b82b7fc263d923b1afc7352658188e3e17f52f75b3caed85764c73c1f721eb7eeaeac6c4813da0aa6a7e7
- SSDEEP 98304:aZBgLCrAZMbyDt4QjH2OFo2Ew+Y9883t9qdAY2EUXHbhbuZOf8eepoVP8BHq:Okkc4Qr2OFoZ+32A3ztuZOkeVPgHq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
spynote
C2
-
91.214.78.18:7771
Signatures
- Spynote family
- Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 3 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD - Requests dangerous framework permissions 1 IoCs
description ioc Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES
File Explorer
-
d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk.apk 5.4MB
-
lariska.apk.apk 3.6MB
lariska.apk
- SHA256 f3df45ca4a6184785d56aeca18a3d05422171f962605c503da303209aad7cb8d
- MD5 05662dcd85b5a5bdb5e2f322938c723c
- SHA1 3c6e0cfde33019c7fff44ac1fd696b817087004a
- SHA512 342a67aa86670efeb8f8f3c882b7bcb1552b13df0bc41bdcf1cf817e888129f898639a3293c0bc11030ea55fb67132b1725363d298cbb77326e4e33e2b0452c4
- SSDEEP 49152:bqYquuzdGGpQTOs0cgrmzE80UtDUTWh8+VzL6aueqN9eU6OeSnBSv/he1/W9X2f:TuzBmTZ0trmzYiiWLdq8SnovZX2f
- MD5 SHA1 SHA512 SSDEEP
trace.editorial.georgia
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.numnoyutbhncvbqkrohuviahfyrunsrsmknmlbxrycrvsresii31
android.permission.SEND_SMS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
oppo.permission.OPPO_COMPONENT_SAFE
oplus.permission.OPLUS_COMPONENT_SAFE
com.huawei.permission.external_app_settings.USE_COMPONENT
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.numnoyutbhncvbqkrohuviahfyrunsrsmknmlbxrycrvsresii31
android.intent.action.CHOOSER
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
com.ui.OnAlarmReceiver.ACTION_WIDGET_RECEIVER
com.android.vending.billing.InAppBillingService.COIN
com.android.vending.billing.InAppBillingService.COIO
com.android.vending.billing.InAppBillingService.LUCM
com.android.vending.billing.InAppBillingService.PROX
ir.cafebazaar.pardakht.InAppBillingService.BIND
ru.aaaaaaax.installer
com.nokia.payment.iapenabler.InAppBillingService.BIND
com.android.vending.billing.InAppBillingService.INST
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.lbnaxdxsqtusamshihuwexlfmlhnoazrqcebqqldoxmxhjtfsu20
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.zqytubhwshxyfxavdfzdwuzjvmitpioypsrxgwujhndnkmfvlz25
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ivhoaxrgmxghswzcktovmvttuivrcgjbsokniiswrdrmxmlayd4.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn70_WBV
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.mousnkzpvyfageuglwrxdijzjxwyozhnmwiskugnnniayvpwvt14_CA
trace.editorial.georgia.xyz
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn72_SCA
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.mousnkzpvyfageuglwrxdijzjxwyozhnmwiskugnnniayvpwvt14
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.mousnkzpvyfageuglwrxdijzjxwyozhnmwiskugnnniayvpwvt14_WKUP
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2._ask_remove_
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.lbnaxdxsqtusamshihuwexlfmlhnoazrqcebqqldoxmxhjtfsu20instll
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.installupdate
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.flygmbtvyrqluuoxsrtkowjhtedbgfvhquhjjzajczsmskjylfmtf12activ
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.openvgowovytbqjhtcekgebonsoeczuzlziexlqupjarfshwztskks9activity
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.openmousnkzpvyfageuglwrxdijzjxwyozhnmwiskugnnniayvpwvt14chrome
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.bjibzbruqccktxmfqzcrsruqyiapjjzbktfnroaayvuhwzetie22
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.jbiizmhgvjaoayjmowktlgbakgzqvjnjzkantuvfliqkuglcjd29net
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.startxqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn7vpn
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.jbiizmhgvjaoayjmowktlgbakgzqvjnjzkantuvfliqkuglcjd29
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.askopvgowovytbqjhtcekgebonsoeczuzlziexlqupjarfshwztskks9poact
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.jbiizmhgvjaoayjmowktlgbakgzqvjnjzkantuvfliqkuglcjd29V2
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.jbiizmhgvjaoayjmowktlgbakgzqvjnjzkantuvfliqkuglcjd29kb
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.fawxrjyeeehgdlfrwugbhmnfsqfujqvetshqsmltljunhfomie21
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.mousnkzpvyfageuglwrxdijzjxwyozhnmwiskugnnniayvpwvt14_AA
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn71
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ivhoaxrgmxghswzcktovmvttuivrcgjbsokniiswrdrmxmlayd4.gmbtvyrqluuoxsrtkowjhtedbgfvhquhjjzajczsmskjylfmtf12
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.anbrdtkumdmjtklkcjhfwtcbrgjpthkdibjsxmtdiyqiormzeu11
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn72
android.accessibilityservice.AccessibilityService
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.Bvgowovytbqjhtcekgebonsoeczuzlziexlqupjarfshwztskks9worker
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.gifbfptkbhvjymjgmlmkzbvdbdiuyhvaxoagyvcepnurgtfeie38
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.Vpnxqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn71Service
android.net.VpnService
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ssbaxsvqxpktkrbcydioctvmywaidwkttytsmthecxousjiuxh27
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.Jobxqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn72Service
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.ovvdzygfoejhjcxybtewonzogkzkejsvudfumwpuvzxnylzguc3.Scujejpcixacdkdcfswjxlbmmhmvdrhcoelgwygefizhczfmehl6IME
android.view.InputMethod
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.zbydgflwxxjlsefovxdrtaejavahekkrjavxlkfvunylrfwwfd5.SRxqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn74B
trace.editorial.georgia.RestartSensor
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.zbydgflwxxjlsefovxdrtaejavahekkrjavxlkfvunylrfwwfd5.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn7
android.intent.action.BOOT_COMPLETED
android.intent.action.ACTION_BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT
android.intent.action.LOCKED_BOOT_COMPLETED
miui.intent.action.BOOT_COMPLETEDT
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.zbydgflwxxjlsefovxdrtaejavahekkrjavxlkfvunylrfwwfd5.mousnkzpvyfageuglwrxdijzjxwyozhnmwiskugnnniayvpwvt14_RC
android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
android.intent.action.MY_PACKAGE_REPLACED
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.zbydgflwxxjlsefovxdrtaejavahekkrjavxlkfvunylrfwwfd5.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn74
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.USER_PRESENT
trace.editorial.hfyxfwtanfkayywtkadsupisewcmdcxdtzrpgslrhikolvlkzq2.zbydgflwxxjlsefovxdrtaejavahekkrjavxlkfvunylrfwwfd5.datexqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn7rec
android.intent.action.DATE_CHANGED
trace.editorial.xqcsduolylbqtburqkjwjnircilvuxlshrfdyayjeykdkmhabn7_AR
android.app.action.DEVICE_ADMIN_ENABLED
androidx.core.content.FileProvider
androidx.core.content.FileProvider
Android Permissions
d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
Permissions
android.permission.REQUEST_INSTALL_PACKAGES
jqzlto.nuhkrf.uehkxv.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION