General

  • Target

    ready.apk

  • Size

    6.2MB

  • MD5

    24de8a5126b73a9c564599af82f5ac89

  • SHA1

    24b35b63378887351be0dd582de1bf82db9e5c12

  • SHA256

    60bbc95a12a5a23a499d6059280e5f45a0b4fbc9f296471291cf18503984737c

  • SHA512

    af431a8141c87a5ed758b819d0ecfeedb3c01a898d82362d7e2bb481b623ccd7e9a550a79e32d33140164d5455a68015e0e9a9f46333d7e2ac87085ae1985daa

  • SSDEEP

    24576:mjL5wKvqLbcYBM/BQlu6kF4G3tSU0Uia2Ol94Y0cz+v:C6Kvq/cADc3sU0Ui25Y

Score
10/10

Malware Config

Extracted

Family

spynote

C2

24.ip.gl.ply.gg:46885

Signatures

  • Spynote family
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 2 IoCs
  • Requests dangerous framework permissions 5 IoCs

Files

  • ready.apk
    .apk android

    childhood.lamb.demographic

    childhood.lamb.cabllhqcyyvfpegfxkhkfhkucursehacwymsttdauluyxfbulj2.eyjhfhrgegscvzsyixyxdlfpwyowhgalauxhvdbidisidhieca31


Android Permissions

ready.apk

Permissions

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.BIND_WALLPAPER

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.BACKGROUND_ACTIVITY_STARTER

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT