spynote | hxxps://mngtuvqc8[.]localto[.]net/kizlar_servis[.]apk

Analysis

max time kernel
121s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260104-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260104-enlocale:en-usos:android-11-x64system
submitted
21/01/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mngtuvqc8.localto.net/kizlar_servis.apk
Sample260121-v5ehpsew7d

Score

10^/10

banker spynote infostealer rat trojan

Malware Config

Extracted

Family

spynote

t9vdmkdro.localto.net:6863

Signatures

Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote
Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-5.dat	family_spynote

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4634

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Size 56B
SHA256 09bda72e7c32a69e3268e0ebd8caa33684cbc954dd00c7d93a38830e348ef324
MD5 cecb649cb1fb79c3736936fcbef3bbf2
SHA1 2c95183d7d2b0cd68d15b3c4115189351fc08720
SHA512 b8aca3cf0ea838093bd29b70ead608597260b0e35886d491d17c304878f99510fd885d96a191080acb5b706a642253bd9cbe5065ff234472b048fcce282061de
TLSH
T13C9002FDA4611009AC2037C01CC122561C1683E430824A0029C23474999432A9C0228C
MD5 SHA1 SHA512 TLSH

Submit Download

.pending-1769621655-kizlar_servis.apk

Path /storage/emulated/0/Download/.pending-1769621655-kizlar_servis.apk
Size 4.7MB
SHA256 36e43b05f0b191960b3f55b0433677a77e80e5ed24f910294ddb1e2e6d6b9164
MD5 03ac38072891a43f8c24656014c42024
SHA1 db8ad0152ec21f9a0b5f9c22d530364831e5745b
SHA512 163b614e496ad70673b21ee82977cd252e148a203a3ea5352650a855c7358d93982f2082ea3a8d5091aad4b4b594d31d9a099197fcc94a20ce1c35cb644afd9f
SSDEEP 98304:44/t3X8dx4E6m0hqdSAxcf26mzHzBATW0tUtRe:fn8dx4E70ccycf21zadr
TLSH
T1E436E043FB44CA9AD9BA83F56F330FA91A171F15CA42AAD74054362D2E771D10ECA6CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pending-1769621655-kizlar_servis.apk (deleted)

Path /storage/emulated/0/Download/.pending-1769621655-kizlar_servis.apk (deleted)
Size 518KB
SHA256 5eb739f0f740e183663d3c0acd414fd844707a12ab931efc99697b7bbe71b251
MD5 c02131bae0dda883ea23cefe1d69fd76
SHA1 7674a8fa7bac2a6d14e28805867c356edc2b1819
SHA512 d21a2113bee1c55f27cb4375ca2998d6bbbd380db1b6cfde61e81298b65cf32801563daf91bfaaecdd9cc8a65a64148024cd513913ead49f60c88d02cfafe076
SSDEEP 192:D1KpAMG+0pI5S3TtaZbqVzwKYEJQS2FpC9hBKT5L7Jl:5K7G+PiGbywcEfCzBKTdL
TLSH
T15FB47E276F4DB358C86B4576122002154C1D50D55FA68A452F2E9F88B762F63AFE3E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads