Overview

overview

10

Static

static

10

Android NoDNS

android-13-x64

10

Android NoDNS

android-9-x86

10

Resubmissions

14/09/2026, 20:09

260914-yxgvmst1gs10

14/09/2026, 20:07

260914-yv3pbsgr5t10

14/09/2026, 20:04

260914-ytbt8at1av10

14/09/2026, 19:16

260914-xyx3kstwgz10

14/09/2026, 15:19

260914-sqfq4sbd7710

14/09/2026, 10:24

260914-mflaysbj7v10

14/09/2026, 10:20

260914-mdfyfsbj4z10

14/09/2026, 10:18

260914-mb2r5sbj3t10

16/08/2025, 01:23

250816-br2arstyfx10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
  • Size 8.7MB
  • Sample250816-br2arstyfx
  • SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
errorfatherspynoteandroidbankerimpactinfostealerrattrojan

Malware Config

Extracted

Family

  • errorfather

C2

  • https://api.telegram.org/bot7779906180:AAE3uTyuoDX0YpV1DBJyz5zgwvvVg-up4xo/sendMessage?chat_id=5915822121&text=

Targets

    • Target
      f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
    • Size 8.7MB
    • SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    spynotebankerimpactinfostealerrattrojan

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

      bankertrojaninfostealerratspynote

    • Spynote family

      spynote

    • Spynote payload

    • Attempts to obfuscate APK file format

      Applies obfuscation techniques to the APK format in order to hinder analysis

    • Declares broadcast receivers with permission to handle system events

    • Declares services with permission to bind to the system

    • Requests dangerous framework permissions

    behavioral1behavioral2

MITRE ATT&CK Mobile v16

Tasks