spynote | 9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306

General

Target

9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306
Size

12.5MB
MD5

12b92b000d9431c19864408c916e558b
SHA1

79349cadfd9309806c398fba2dd6d5825f772a8a
SHA256

9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306
SHA512

d11473dba6edba3a99cf732f90fc2b546321e4d137e023f065e74932b2d8d040593ea8c8f3fc2da9a8bf6d3b137bc2fdba83f0ac427795caf510de8372116bac
SSDEEP

196608:Ia96xtqAw4Eo42eaAew7uySoImf7AMAr7+2LTaD2cUMYNkIuJtUZr2pvgXckYU:I1tVwD2tPoImEM92LTaKo7wipoMDU

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

C2

103.74.105.194:7006

Signatures

Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS

Files

9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306
.apk android

com.tcmso.poms9000k

com.app.ccj5000k.ActivitySplash

Activities

ginom.alfa.lib.scan.Camerasbyicwtesfhdgosxqnzjorbne1Activity

xyz

com.app.ccj5000k.SendSmsActivity

android.intent.action.SEND
android.intent.action.SENDTO

com.app.ccj5000k.ActivitySplash

android.intent.action.MAIN

Permissions

android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
com.google.android.c2dm.permission.RECEIVE
android.permission.VIBRATE
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.WRITE_SETTINGS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_MMS

Receivers

ginom.alfa.lib.scan.Customsbyicwtesfhdgosxqnzjorbne1Receiver

RestartSensor

ginom.alfa.lib.scan.Bootsbyicwtesfhdgosxqnzjorbne1Receiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.LOCKED_BOOT_COMPLETED

ginom.alfa.lib.scan.Packagessbyicwtesfhdgosxqnzjorbne1Receiver

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED

ginom.alfa.lib.scan.Screensbyicwtesfhdgosxqnzjorbne1Receiver

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.Intent.ACTION_USER_PRESENT

ginom.alfa.lib.scan.Callssbyicwtesfhdgosxqnzjorbne1Receiver

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

com.app.ccj5000k.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.app.ccj5000k.adapter.MyReciever

android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.SMS_DELIVER

Services

ginom.alfa.lib.scan.Accesssbyicwtesfhdgosxqnzjorbne1Services

android.accessibilityservice.AccessibilityService

com.app.ccj5000k.SmsSendService

android.intent.action.RESPOND_VIA_MESSAGE

Android Permissions

9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306

Permissions

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

com.google.android.c2dm.permission.RECEIVE

android.permission.VIBRATE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WRITE_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_MMS

Sharing

General

Malware Config

Extracted

Signatures

Files

com.tcmso.poms9000k

com.app.ccj5000k.ActivitySplash

Activities

ginom.alfa.lib.scan.Camerasbyicwtesfhdgosxqnzjorbne1Activity

com.app.ccj5000k.SendSmsActivity

com.app.ccj5000k.ActivitySplash

Permissions

Receivers

ginom.alfa.lib.scan.Customsbyicwtesfhdgosxqnzjorbne1Receiver

ginom.alfa.lib.scan.Bootsbyicwtesfhdgosxqnzjorbne1Receiver

ginom.alfa.lib.scan.Packagessbyicwtesfhdgosxqnzjorbne1Receiver

ginom.alfa.lib.scan.Screensbyicwtesfhdgosxqnzjorbne1Receiver

ginom.alfa.lib.scan.Callssbyicwtesfhdgosxqnzjorbne1Receiver

com.app.ccj5000k.MmsReceiver

com.app.ccj5000k.adapter.MyReciever

Services

ginom.alfa.lib.scan.Accesssbyicwtesfhdgosxqnzjorbne1Services

com.app.ccj5000k.SmsSendService

Android Permissions

9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306