spymax | spy-max-master[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
spy-max-master.zip
Size 249KB
Sample250305-tbcatasm15
SHA256 747b140911d9bb55eb8e86ce29e8782a09bed92b8f956083612cf94ac10feea4
MD5 61926eb79d92c2f51050c8d2ba64f87f
SHA1 7c1df147e033ff4c3fbe5bdf7fc8859fd8793c5f
SHA512 c7c3bda15cd23fbb4a05a267fc2edd8d8b7c04acc04e64687495ed1f681df72691fd922e0d5e3be025cf414e9497cd87d87af91bfbd86d67b13740f352bd75e4
SSDEEP 6144:DuIOquIOQLRzsh407dFjZa1GUjHGQmlsu/YARJJHl19N:DuIOquIO2Rsx5ZaJLGdlsRuJX1/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spymax

Malware Config

Extracted

Family

spymax

[SPY_MAX_IP]:[SPY_MAX_PORT]

Signatures

Spymax family
spymax

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/spy-max-master/Spy MAX.exe

File Explorer

spy-max-master.zip

.zip 249KB
spy-max-master/PATCH-SDK26.apk

.apk 28KB
spy-max-master/PATCH-SDK28.apk

.apk 28KB
spy-max-master/Spy MAX.exe

.exe 530KB

spy-max-master.zip

SHA256 747b140911d9bb55eb8e86ce29e8782a09bed92b8f956083612cf94ac10feea4
MD5 61926eb79d92c2f51050c8d2ba64f87f
SHA1 7c1df147e033ff4c3fbe5bdf7fc8859fd8793c5f
SHA512 c7c3bda15cd23fbb4a05a267fc2edd8d8b7c04acc04e64687495ed1f681df72691fd922e0d5e3be025cf414e9497cd87d87af91bfbd86d67b13740f352bd75e4
SSDEEP 6144:DuIOquIOQLRzsh407dFjZa1GUjHGQmlsu/YARJJHl19N:DuIOquIO2Rsx5ZaJLGdlsRuJX1/
MD5 SHA1 SHA512 SSDEEP

spy-max-master/PATCH-SDK26.apk

SHA256 cde47bed5ec83e29f6455ec35228c3f56d488393668f5b720b79fcd6cb3bc098
MD5 ac7e3b5bcd591fe15bf2c5aa43f389a8
SHA1 9bfb12f6b99c9d7e80123c224a3c0d89fede5c58
SHA512 a17dfaaf85f7347772981b91bbaa7c117d38d18213b2dec8e37f62a7fc5516002e0705e54b243df46ec96e4d998ef6fb58d5a1bbdb9a9a9a546012c53fe36efe
SSDEEP 768:T7qKKd3PyfFrT2GJxeEUaDWD2RKFCl3fp66/YzL:T4P8eGJxOaDJ66/YzL
MD5 SHA1 SHA512 SSDEEP

android

spymax.stub7.suffix

spy-max-master/PATCH-SDK28.apk

SHA256 cde47bed5ec83e29f6455ec35228c3f56d488393668f5b720b79fcd6cb3bc098
MD5 ac7e3b5bcd591fe15bf2c5aa43f389a8
SHA1 9bfb12f6b99c9d7e80123c224a3c0d89fede5c58
SHA512 a17dfaaf85f7347772981b91bbaa7c117d38d18213b2dec8e37f62a7fc5516002e0705e54b243df46ec96e4d998ef6fb58d5a1bbdb9a9a9a546012c53fe36efe
SSDEEP 768:T7qKKd3PyfFrT2GJxeEUaDWD2RKFCl3fp66/YzL:T4P8eGJxOaDJ66/YzL
MD5 SHA1 SHA512 SSDEEP

android

spymax.stub7.suffix

spy-max-master/Spy MAX.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 afbc0414c3778e84d0a23d3a1e934b00fabde4390804702a212c1f1018fffbcf
MD5 2d00b1f7d3b15637cc0ae2be68fb872a
SHA1 f42f12cff9cc7634fdc65284b040d94cc128f3e2
SHA512 1d4b180cf858691679f264cc229fd07b07cd69ce609d1e2c9ffd59f2ce591c25b127d58d9a464c815f5fe4c1aadecdcedde2bf86dc6ebe5960c4725db11594bd
SSDEEP 12288:VG4MCrtpiIVZpiIV+8hyQLTZAlgrd+Cpkuodt4mnCzeq9ysmiIE:VrpiIfpiIsomCCq9yMIE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

516862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\GAMER\Desktop\AngelAndroid\AngelAndroid\obj\Release\Spy MAX.pdb

spy-max-master.zip

spy-max-master/PATCH-SDK26.apk

spymax.stub7.ClassGen9

spymax.stub7.ClassGen11

spymax.stub7.ClassGen6

spymax.stub7.ClassGen5

spymax.stub7.ClassGen12

spymax.stub7.ClassGen13

spymax.stub7.ClassGen1

spymax.stub7.ClassGen14