spynote | Google[.]apk

General

Target
Google.apk
Size 4.4MB
Sample260403-vccteabs71
SHA256 b600af54745d2cf6529d048e701b579368af19ff69a08b5ae26d1f0d0a706047
MD5 00042fa56e1113e00c44f7630ee3e428
SHA1 a1ebf362592c10a00b892a6dec930134be6163d5
SHA512 0bf9a4a4815bfcbf1d30d2d1d24690ddb7a1a80adc75236d85aac704fa5af52dd3334ad1e7049991374f4d0570775949bd839b340d7fa608fbb087c7d86bea09
SSDEEP 98304:AT8OFRGW75+bJ8UvBVMyLbGmzozBXTE0t4g98L5:LExQZVMyL9zM33e
TLSH
T11E26F103FB54D68BDAAE83F26F270C9916175F14C692A6D740107A7E2EB72C10DC6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spynote

Malware Config

Signatures

Spynote family
spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Google.apk

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Google.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Google.apk

File Explorer

Google.apk

.apk 4.4MB

Google.apk

SHA256 b600af54745d2cf6529d048e701b579368af19ff69a08b5ae26d1f0d0a706047
MD5 00042fa56e1113e00c44f7630ee3e428
SHA1 a1ebf362592c10a00b892a6dec930134be6163d5
SHA512 0bf9a4a4815bfcbf1d30d2d1d24690ddb7a1a80adc75236d85aac704fa5af52dd3334ad1e7049991374f4d0570775949bd839b340d7fa608fbb087c7d86bea09
SSDEEP 98304:AT8OFRGW75+bJ8UvBVMyLbGmzozBXTE0t4g98L5:LExQZVMyL9zM33e
TLSH
T11E26F103FB54D68BDAAE83F26F270C9916175F14C692A6D740107A7E2EB72C10DC6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

a627cd70572bbc446975af75423198c64a189967

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Chains

Jan 1, 0001

com.whh.premium

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.MainActivity

android.intent.action.MAIN

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.dlcrtiizmagixadljslmogaydyfbawtfpukudabqqcfiauwuch20

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.FloatingView

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.lguefghgodieaugvsmhiitfuuuivnlkbidbdrptqoaponmgwtv4.CraxsBrowser

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.CameraActvity

com.whh.premium.xyz

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestScreenCap

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.SecondActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.WakeupActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestUninstall

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestInstallPrim

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.installupdate

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.flyActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.OpenActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.OpenChrome

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.kybulhgqgthnstrupyoebsoajzukcqxrlgnmwtvwmtzavarvcm22Over

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestDataUsage

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestVPN

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.zdbaaimowoafkbrvwwmitcosigmoowhybulqreguyfadcrizbw29

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestOPPOB

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestPermission2

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestKeyboard

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.cwoczjkuzivdqnbzmgsynuyojbzxgyvnefjcghywmglubjduel21

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestAdmin

Android Permissions

Google.apk

Permissions

android.permission.SEND_SMS

android.permission.SET_WALLPAPER

android.permission.READ_SMS

android.permission.READ_CALL_LOG

android.permission.READ_CONTACTS

android.permission.GET_ACCOUNTS

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CALL_PHONE

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Signatures

File Explorer

Google.apk

File Signature issue

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.MainActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.dlcrtiizmagixadljslmogaydyfbawtfpukudabqqcfiauwuch20

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.FloatingView

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.lguefghgodieaugvsmhiitfuuuivnlkbidbdrptqoaponmgwtv4.CraxsBrowser

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.CameraActvity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestScreenCap

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.SecondActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.WakeupActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestUninstall

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestInstallPrim

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.installupdate

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.flyActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.OpenActivity

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.OpenChrome

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.kybulhgqgthnstrupyoebsoajzukcqxrlgnmwtvwmtzavarvcm22Over

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestDataUsage

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestVPN

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.zdbaaimowoafkbrvwwmitcosigmoowhybulqreguyfadcrizbw29

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestOPPOB

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestPermission2

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestKeyboard

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.cwoczjkuzivdqnbzmgsynuyojbzxgyvnefjcghywmglubjduel21

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.RequestAdmin

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.initializeService

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.lguefghgodieaugvsmhiitfuuuivnlkbidbdrptqoaponmgwtv4.CameraHandler

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.LocationService

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.AccessService

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.BackgroundWorker

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.gsewazdmffonwkvrrpiieircigwhmcqyvbtxoutsemlknnbytq38

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.FirewallServices

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.lzarvbthcfuzhtkykvbmughtujwqoozigtixdryqbrwnmyvxnc27ture

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.MyJobService

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.ezsdwtyvergvuxftryemrutyrkhccgizeogbhosgahiqkrqagq3.KeyboardService

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.sxrnsvzlghhsilfefuwxasdhkjvtqkwuleunszwzsrviruxqtr5.CustomReceiver

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.sxrnsvzlghhsilfefuwxasdhkjvtqkwuleunszwzsrviruxqtr5.BootReceiver

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.sxrnsvzlghhsilfefuwxasdhkjvtqkwuleunszwzsrviruxqtr5.PackagesReceiver

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.sxrnsvzlghhsilfefuwxasdhkjvtqkwuleunszwzsrviruxqtr5.ScreenReceiver

com.whh.tlcxryjvpwcypcgtkkqshldiopzcnjnmxrauawffmudogcwqaj2.sxrnsvzlghhsilfefuwxasdhkjvtqkwuleunszwzsrviruxqtr5.Datareciver

com.whh.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

Google.apk