spynote | 97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403

General

Target

97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403
Size

12.5MB
MD5

42ad0ff73e0b4295a4ae2ca600b9e5fa
SHA1

7dd9260843bb1ee8613fc2eb913e776b4c0fcbb4
SHA256

97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403
SHA512

59efd73b3eb3ff2a17bf88b42575d142fd54c9eda6eb5316444efa14c1980991e11e1780ea3f71d082d5bef7ec74fe023d221ed962b083650ed9f4c6ffc766ee
SSDEEP

196608:mAgbdVg7aNmVAcIro36mugUFcs1Pohd2r7+2Lejjd/1dTWr2pRCYgY8:mAg5N8Atro78cskT2LijZHWipRFP8

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

C2

103.74.105.194:7003

Signatures

Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS

Files

97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403
.apk android

com.shes.maox3000k

com.app.maox3000k.ActivitySplash

Activities

ginom.alfa.lib.scan.Camerawlykmmcrrxtuqljavdncyefxe1Activity

xyz

com.app.maox3000k.SendSmsActivity

android.intent.action.SEND
android.intent.action.SENDTO

com.app.maox3000k.ActivitySplash

android.intent.action.MAIN

Permissions

android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
com.google.android.c2dm.permission.RECEIVE
android.permission.VIBRATE
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.WRITE_SETTINGS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_MMS

Receivers

ginom.alfa.lib.scan.Customwlykmmcrrxtuqljavdncyefxe1Receiver

RestartSensor

ginom.alfa.lib.scan.Bootwlykmmcrrxtuqljavdncyefxe1Receiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.LOCKED_BOOT_COMPLETED

ginom.alfa.lib.scan.Packageswlykmmcrrxtuqljavdncyefxe1Receiver

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED

ginom.alfa.lib.scan.Screenwlykmmcrrxtuqljavdncyefxe1Receiver

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.Intent.ACTION_USER_PRESENT

ginom.alfa.lib.scan.Callswlykmmcrrxtuqljavdncyefxe1Receiver

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

com.app.maox3000k.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.app.maox3000k.adapter.MyReciever

android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.SMS_DELIVER

Services

ginom.alfa.lib.scan.Accesswlykmmcrrxtuqljavdncyefxe1Services

android.accessibilityservice.AccessibilityService

com.app.maox3000k.SmsSendService

android.intent.action.RESPOND_VIA_MESSAGE

Android Permissions

97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403

Permissions

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

com.google.android.c2dm.permission.RECEIVE

android.permission.VIBRATE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WRITE_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_MMS

Sharing

General

Malware Config

Extracted

Signatures

Files

com.shes.maox3000k

com.app.maox3000k.ActivitySplash

Activities

ginom.alfa.lib.scan.Camerawlykmmcrrxtuqljavdncyefxe1Activity

com.app.maox3000k.SendSmsActivity

com.app.maox3000k.ActivitySplash

Permissions

Receivers

ginom.alfa.lib.scan.Customwlykmmcrrxtuqljavdncyefxe1Receiver

ginom.alfa.lib.scan.Bootwlykmmcrrxtuqljavdncyefxe1Receiver

ginom.alfa.lib.scan.Packageswlykmmcrrxtuqljavdncyefxe1Receiver

ginom.alfa.lib.scan.Screenwlykmmcrrxtuqljavdncyefxe1Receiver

ginom.alfa.lib.scan.Callswlykmmcrrxtuqljavdncyefxe1Receiver

com.app.maox3000k.MmsReceiver

com.app.maox3000k.adapter.MyReciever

Services

ginom.alfa.lib.scan.Accesswlykmmcrrxtuqljavdncyefxe1Services

com.app.maox3000k.SmsSendService

Android Permissions

97cf6752734816208ff03eea523825bcfc7270d52d8c5f0f02951236885e0403