spynote | kızlarsohbet[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
kızlarsohbet.apk
Size 4.7MB
Sample260118-vhm7bsbt4d
SHA256 2e57cb3f0c6a71d195bf79a8099ac36203b748b4093a4163984b50690b6d8831
MD5 9c9e5ebf65ea7fb5f20bca243f182fcb
SHA1 8f194d3838230a6ebcebbe52a14a0aeba1783ac5
SHA512 16dd7bb751babf97002a49969a5ed486d7750114fea5133c9b37eb3e82aecab53c957678fcf7a46a17566ab65edc4928cf9e1b25da72acac2fffb61f07f556ce
SSDEEP 98304:vVJZtJKD8InpWrhS+2JmGrJmkO+Wmz9zBoT20toY06l:vnBGUrAZmuJmKhzc9KY
TLSH
T18D36DF43FB45CADAD8B983F56F370FA91A1B0F14C642AAD740147A6E2D771C50E86ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

yxtu8a6fk.localto.net:3143

Signatures

Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
kızlarsohbet.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
kızlarsohbet.apk

File Explorer

kızlarsohbet.apk

.apk 4.7MB

kızlarsohbet.apk

SHA256 2e57cb3f0c6a71d195bf79a8099ac36203b748b4093a4163984b50690b6d8831
MD5 9c9e5ebf65ea7fb5f20bca243f182fcb
SHA1 8f194d3838230a6ebcebbe52a14a0aeba1783ac5
SHA512 16dd7bb751babf97002a49969a5ed486d7750114fea5133c9b37eb3e82aecab53c957678fcf7a46a17566ab65edc4928cf9e1b25da72acac2fffb61f07f556ce
SSDEEP 98304:vVJZtJKD8InpWrhS+2JmGrJmkO+Wmz9zBoT20toY06l:vnBGUrAZmuJmKhzc9KY
TLSH
T18D36DF43FB45CADAD8B983F56F370FA91A1B0F14C642AAD740147A6E2D771C50E86ACC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Codesign digest Mismatch

File was altered after it was signed.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b8c57a39a835ff199a0a55ba60d88ba9f51babc2d1d0d4a3516446f832875099

Digest Algorithm

sha256

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Chains

Jan 1, 0001

io.orders.tears

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6SJTMB87

android.intent.action.MAIN

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6GqoLQ101

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6kYlJO67

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6bxqkG55

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6XVLHn31

io.orders.tears.xyz

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6utYfS119

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6kaIad128

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6CYdNZ140

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6uMxDX120

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6druGV111

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6WiPZq73

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6CWhPr69

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6fFmxI93

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6ocDMs94

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6KosYj109

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6EPUZu106

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6vMTZQ121

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6VVBQl118

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6JsOfG116

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6NgOaV117

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6bKMLn114

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6jlxqP103

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6fixnS102

Android Permissions

kızlarsohbet.apk

Permissions

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.CAMERA

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.RECORD_AUDIO

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

kızlarsohbet.apk

File Signature issue

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6SJTMB87

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6GqoLQ101

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6kYlJO67

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6bxqkG55

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6XVLHn31

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6utYfS119

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6kaIad128

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6CYdNZ140

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6uMxDX120

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6druGV111

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6WiPZq73

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6CWhPr69

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6fFmxI93

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6ocDMs94

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6KosYj109

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6EPUZu106

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6vMTZQ121

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6VVBQl118

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6JsOfG116

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6NgOaV117

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6bKMLn114

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6jlxqP103

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6fixnS102

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6aEgDk72

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6eVKQk35

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6dRFVL76

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6nSsAP24

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6NVnDQ28

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6zrxWI48

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6yVghL62

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6sltWG132

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6icJWw90

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6njgBS74

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6gcmZn57

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6xTPit30

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6mshyY96

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6OYega123

io.orders.qjheanwautbzpzyjftomafrbazyybgjhnzvwdgjohhqkybehvj2.ssaqntzujntaxemluvxlmıfıwvsmbjjgfsuppeyımsqmwrvnhc6oBnVr59

io.orders.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

kızlarsohbet.apk