spymax | ready[.]apk

General

Target
ready.apk
Size 29KB
Sample260112-m4v53adv4c
SHA256 cc35ef7eb0ba55bf986fb27da4969a72b7e6406e31db92b138dca4782cf0cbbc
MD5 51006815bfe958d31f544bbf5c5a00b5
SHA1 2ec118ab5ed7a54f31a13d5e4d48014b4d0f5570
SHA512 d850bfc909b921ae4eba8b64dfdb273d96e8c8f701a2d926653afc587355693943853c986345d7c3773110be3f55e594f0555304d537030fd36b966a74e2ae9d
SSDEEP 768:Hw+tu5BKKEJPlDXhXCPNQiRdbkQIxIn0AUs0Pl6E:QtLKKEJ1XhXmRdbko8s0EE
TLSH
T136D2E13B2E53E15AD25EB731153580269D36BA30D78AF38B1404CD6EAE2BEC5574319C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spymax

Malware Config

Extracted

Family

spymax

C2

artemkalenadov-42277.portmap.host:42277

Signatures

Spymax family
spymax

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
ready.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ready.apk

File Explorer

ready.apk

.apk 29KB

ready.apk

SHA256 cc35ef7eb0ba55bf986fb27da4969a72b7e6406e31db92b138dca4782cf0cbbc
MD5 51006815bfe958d31f544bbf5c5a00b5
SHA1 2ec118ab5ed7a54f31a13d5e4d48014b4d0f5570
SHA512 d850bfc909b921ae4eba8b64dfdb273d96e8c8f701a2d926653afc587355693943853c986345d7c3773110be3f55e594f0555304d537030fd36b966a74e2ae9d
SSDEEP 768:Hw+tu5BKKEJPlDXhXCPNQiRdbkQIxIn0AUs0Pl6E:QtLKKEJ1XhXmRdbko8s0EE
TLSH
T136D2E13B2E53E15AD25EB731153580269D36BA30D78AF38B1404CD6EAE2BEC5574319C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

393f697131c37104d200c4c9d1eb888270d75a76

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Benim ismim,OU=Benim Firmam,O=Benim Firmam,L=Antan,ST=SANANE,C=rb,1.2.840.113549.1.9.1=#0c0f736168746540676d61696c2e636f6d

Chains

Jan 1, 0001

package.name.suffix

Android Permissions

ready.apk

Permissions

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.READ_SMS

android.permission.READ_CALL_LOG

android.permission.READ_CONTACTS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_ACCOUNTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CAMERA

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECORD_AUDIO

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.WRITE_CALL_LOG

android.permission.WRITE_CONTACTS

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

com.oppo.launcher.permission.READ_SETTINGS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.CALL_PHONE

android.permission.SET_WALLPAPER

ready.apk

File Signature issue

package.name.njlhqouvbqevsbrmlgkqlsaloandjitvmk2583

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25761

package.name.bylcqwoxrxgrmardxsvcfsbuihdemotopembtovopnetvrmtmcxzrviix2581

package.name.wdsmmhdcbxzjnchwokwsfeqshuwtxqbiheensipeghqptwrgwjsjlbnsnaerlkelwrbiytegusmy2580

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25762

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25763

package.name.wgckgajygykmfnyfgdbvosxksvxwgb2576

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25764

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ready.apk

File Signature issue

package.name.njlhqouvbqevsbrmlgkqlsaloandjitvmk2583

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25761

package.name.bylcqwoxrxgrmardxsvcfsbuihdemotopembtovopnetvrmtmcxzrviix2581

package.name.wdsmmhdcbxzjnchwokwsfeqshuwtxqbiheensipeghqptwrgwjsjlbnsnaerlkelwrbiytegusmy2580

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25762

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25763

package.name.wgckgajygykmfnyfgdbvosxksvxwgb2576

package.name.wgckgajygykmfnyfgdbvosxksvxwgb25764

Android Permissions

ready.apk