promptspy | 0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d[.]apk

Resubmissions

21/04/2026, 09:56

260421-lybnssft31

05/12/2025, 04:28

251205-e3xcqsskay10

03/12/2025, 12:23

251203-pkwnlayrdk10

Sharing

Copy URL Twitter E-mail

General

Target
0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk
Size 4.7MB
Sample260421-lybnssft31
SHA256 0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d
MD5 0e73498f73c059a94e465ca5a4ebdf05
SHA1 6c9382d4c715ca9915105b5183d5fb7019af0015
SHA512 1a6c4630c0fdca1f9ba34a1922cc3fda6f3899ca64610d009c69c237076ad7d1be310d400ec6ecdb863676ad0684234d99f094c39ae75be238e6ef0c998891b3
SSDEEP 98304:3iOQbTgr4C7V1X/JJU+9FA31amsSYSizvITd/ee0VrJG:3LQeP7V1Xzu1nsSYSlpGef
TLSH
T13336E14AFF4DD83FD9B750391F4A067136166C668A92D3872411732CBAB7BC81E1ABD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat promptspy banker sturnus

Malware Config

Extracted

Family

sturnus

https://cdn.almondcollections.com
https://walnut.almondcollections.com

aes.base64

Signatures

Family: PromptSpy
PromptSpy is an Android spyware that abuses generative AI, first seen in February 2026.
trojan infostealer rat promptspy
Family: Sturnus
Sturnus is an Android banking trojan that targets user credentials and can bypass encrypted messages, first seen in November 2025.
banker trojan infostealer rat sturnus

Detects PromptSpy 1 IoCs

resource	yara_rule
sample	family_promptspy

Sturnus payload 1 IoCs

resource	yara_rule
sample	family_sturnus

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk

File Explorer

0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk

.apk 4.7MB

0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk

SHA256 0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d
MD5 0e73498f73c059a94e465ca5a4ebdf05
SHA1 6c9382d4c715ca9915105b5183d5fb7019af0015
SHA512 1a6c4630c0fdca1f9ba34a1922cc3fda6f3899ca64610d009c69c237076ad7d1be310d400ec6ecdb863676ad0684234d99f094c39ae75be238e6ef0c998891b3
SSDEEP 98304:3iOQbTgr4C7V1X/JJU+9FA31amsSYSizvITd/ee0VrJG:3LQeP7V1Xzu1nsSYSlpGef
TLSH
T13336E14AFF4DD83FD9B750391F4A067136166C668A92D3872411732CBAB7BC81E1ABD0
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

Detects PromptSpy
Sturnus payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

35f8e5018e07ef44a25afeddd07cb3a1c03ce10e213b4accb4a07b553c3f7fda

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Google Chrome,OU=Google,O=Google Inc,L=Mountain View,ST=California,C=US

com.uvxuthoq.noscjahae

com.chrome.wupdater.rcvs.dar

android.app.action.DEVICE_ADMIN_ENABLED android.app.action.PROFILE_PROVISIONING_COMPLETE android.intent.action.BOOT_COMPLETED android.app.action.PROFILE_OWNER_CHANGED android.app.action.DEVICE_OWNER_CHANGED

com.chrome.wupdater.rcvs.btrcv

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.SHUTDOWN

com.chrome.wupdater.rcvs.smrcv

android.provider.Telephony.SMS_RECEIVED

com.chrome.wupdater.sms.smsdr

android.provider.Telephony.SMS_DELIVER

com.chrome.wupdater.sms.wappr

android.provider.Telephony.WAP_PUSH_DELIVER

com.chrome.wupdater.rcvs.btr

android.intent.action.BATTERY_CHANGED android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

com.chrome.wupdater.rcvs.wrcv

android.net.wifi.STATE_CHANGE android.net.wifi.WIFI_STATE_CHANGED

com.chrome.wupdater.rcvs.air

android.intent.action.AIRPLANE_MODE

com.chrome.wupdater.rcvs.uus

android.intent.action.UMS_CONNECTED android.intent.action.UMS_DISCONNECTED

com.chrome.wupdater.rcvs.ssrcv

android.intent.action.SIM_STATE_CHANGED

com.chrome.wupdater.rcvs.scrv

com.chrome.wupdater.rcvs.ir

android.net.conn.CONNECTIVITY_CHANGE

com.chrome.wupdater.rcvs.dlr

android.intent.action.USER_PRESENT android.intent.action.USER_UNLOCKED

com.chrome.wupdater.rcvs.pr

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_CHANGED android.content.pm.action.PACKAGE_INSTALL android.content.pm.action.PACKAGE_REPLACED

com.chrome.wupdater.rcvs.btrs

android.os.action.POWER_SAVE_MODE_CHANGED

com.chrome.wupdater.rcvs.rig

android.media.RINGER_MODE_CHANGED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk

Permissions

android.permission.GET_ACCOUNTS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.ACCESS_WIFI_STATE

android.permission.BIND_DEVICE_ADMIN

android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

android.permission.DEVICE_POWER

android.permission.QUERY_ALL_PACKAGES

android.permission.GET_APP_OPS_STATS

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTED

android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE

android.permission.BLUETOOTH_CONNECT

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_SMS

android.permission.READ_CONTACTS

android.permission.SEND_SMS

android.permission.TRANSMIT_IR

android.permission.USE_BIOMETRIC

android.permission.RECEIVE_MMS

android.permission.RECEIVE_WAP_PUSH

android.permission.READ_SMS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.SCHEDULE_EXACT_ALARM

android.permission.START_ACTIVITIES_FROM_BACKGROUND

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.EXPAND_STATUS_BAR

miui.permission.USE_INTERNAL_GENERAL_API

android.permission.GET_TASKS

com.uvxuthoq.noscjahae.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk

File Signature issue

com.chrome.wupdater.MainActivity

com.chrome.wupdater.ovd.jin

com.chrome.wupdater.rpa

com.chrome.wupdater.sms.smsa

com.chrome.wupdater.ivcc.mpra

com.chrome.wupdater.srcv.ajs

androidx.work.impl.background.systemjob.SystemJobService

com.chrome.wupdater.srcv.bgs

com.chrome.wupdater.srcv.wbs

com.chrome.wupdater.srcv.acs

com.chrome.wupdater.sms.hsss

com.chrome.wupdater.srcv.ntfy

com.chrome.wupdater.acsb.accs

com.chrome.wupdater.ivcc.msrv

com.chrome.wupdater.ivcc.mpsr

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.chrome.wupdater.rcvs.dar

com.chrome.wupdater.rcvs.btrcv

com.chrome.wupdater.rcvs.smrcv

com.chrome.wupdater.sms.smsdr

com.chrome.wupdater.sms.wappr

com.chrome.wupdater.rcvs.btr

com.chrome.wupdater.rcvs.wrcv

com.chrome.wupdater.rcvs.air

com.chrome.wupdater.rcvs.uus

com.chrome.wupdater.rcvs.ssrcv

com.chrome.wupdater.rcvs.scrv

com.chrome.wupdater.rcvs.ir

com.chrome.wupdater.rcvs.dlr

com.chrome.wupdater.rcvs.pr

com.chrome.wupdater.rcvs.btrs

com.chrome.wupdater.rcvs.rig

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

Android Permissions

0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d.apk