spynote | f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7

max time kernel
6s
max time network
25s
platform
android-13_x64
resource
android-33-x64-arm64-20250619-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20250619-enlocale:en-usos:android-13-x64system
submitted
16/08/2025, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7.apk
Size 8.7MB
Sample250816-br2arstyfx
SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
MD5 12f5c6dd1ffdddab60d6da95216274e5
SHA1 77299594efea59d7c1d7a32fed95f35e24b8f874
SHA512 9f82fcc715ee6a8560e8092fe334e4e259d202fcb0f76c28134b2f1451bedc3f867bdace0e5d1ac5b739c642d395c4f915e89b016b9748ad229d2af07fce4e22
SSDEEP 196608:1VrMawyBMI8WszaGO/xohiP1V5C01VeeUK2zDr5Pqz8tW+:Xgawyx82GOJ4iPD1Ve9DrlXtW+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

spynote banker impact infostealer rat trojan

Malware Config

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote
Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_spynote

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cosmos.scrubber.pupil

cosmos.scrubber.pupil
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4479

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 8.2MB
SHA256 06d87d22601637e282a1c81a241fc77e105ae77023ea7476fc07f0f3aa6ee833
MD5 93926cbee6159a0a3b6b44931d78680f
SHA1 6cf7ff1959f416d23d5132084603f1343676590e
SHA512 c64ca5942a6bf9eae2e687df893cb4ffda6c1d4af99aa44bbaee34a74133d692686ce9c6b6ade02d766d0106951ab819068acbe8cd2c192ed03530f3d278a302
SSDEEP 196608:h0Ybz7OAcoPw5KR1V2tFFerG5d+jRNc8D3a8LNBoQD3rrXbh3nD:h0EBrP+q1eFQrWd03pNBoQPrbhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ۦۖ۫

Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
Size 8.0MB
SHA256 abefa69eaf00b4ac0807e82d430ff08d65241dba1badcce7f1dd04a002c057bf
MD5 bcce4b674b7af3409da3ecbb3dc10ec0
SHA1 7270e5129d1730d05767158bc6fb4af8085815f9
SHA512 369a92fc3d988286f7d600885a8365cff90767daee796edfb593876658eb47362ddf5feaa046fb7eae6c869e5193f81a0413c56afe3c2fe86e4b13d921f20824
SSDEEP 196608:cZyeXihM3JI+NmqVODWtD3sDM334jRVui5fC4HiOWsTVODxHyO/2O+cPNf:cZjHJrNFOoDcDo3Qf9C3sTgt/lNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ۦۖ۫.

Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads