spynote | Craxs rat mobile V1[.]apk

Target
Craxs rat mobile V1.apk
Size 5.4MB
Sample260503-b89ngaav6t
SHA256 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5
MD5 5957b575bb39d2ae9cf18325d754938f
SHA1 2e7f4ce732c1f7f00b10c929bfcc70753693dfc9
SHA512 cd332a7d1d9e1a44794f05e866c42c7d0f23d8b48ad56a59ccda877f6e10617073e55afee4289956dca530a2286ba5d3ab00812b43e6b6026873862a448ff849
SSDEEP 98304:zuq6DHpO1xrQs/y64AJ+IDkaP5LUT2cUxtjnmUKMyhrFZIAFANHg1vTNqE/t:z6DpUFnjkaPxWUXmUKtrFfWNH2L4E1
TLSH
T1B4463349F348C591F64BB6BDC9A18376F522BD590B5B9BC0B48924CC6DFFA640323A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
static1/unpack001/childapp.apk	family_spynote

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
Craxs rat mobile V1.apk
unpack001/childapp.apk

File Explorer

Craxs rat mobile V1.apk

.apk 5.4MB
childapp.apk

.apk 61.1MB

Craxs rat mobile V1.apk

SHA256 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5
MD5 5957b575bb39d2ae9cf18325d754938f
SHA1 2e7f4ce732c1f7f00b10c929bfcc70753693dfc9
SHA512 cd332a7d1d9e1a44794f05e866c42c7d0f23d8b48ad56a59ccda877f6e10617073e55afee4289956dca530a2286ba5d3ab00812b43e6b6026873862a448ff849
SSDEEP 98304:zuq6DHpO1xrQs/y64AJ+IDkaP5LUT2cUxtjnmUKMyhrFZIAFANHg1vTNqE/t:z6DpUFnjkaPxWUXmUKtrFfWNH2L4E1
TLSH
T1B4463349F348C591F64BB6BDC9A18376F522BD590B5B9BC0B48924CC6DFFA640323A31
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

c7ac4fcc63bbdc8d04ac08a4b61af1114f50ad208b4c49e0448705f83aff9bc9

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.appd.instll.load

childapp.apk

SHA256 613dfad45a7696818e1fb73d6892bb52cad7231c305f70db1c9cbbbcfab2c76d
MD5 0b164382ea5279ba6baaa2f0f6fc99af
SHA1 58bf6ab3f5f854431d14f162e926759aed59e2e5
SHA512 056e6c41a6bdb0f715a1f46d97da168d135c411dd978295fb73137f2d027f906f1d4601685fa5776f118ec662eee2d85886506237185f44931829ebcab94536c
SSDEEP 98304:zrp2DuCvLN44WzpF1Cuqmsf5RjaECmzzzBCTW0t4n67Yn:+uCv1WHEugf5gEtzcdb8n
TLSH
T101E7F143FB46CA8BD8BE83F56B370FA91E070F198642A6D35855766E2E771C00D85ACC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

5f1201c456586453c2388d9714a06becb69e1e16d1bfd6a5b0790fdb253d51bc

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

bob.display.aug

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.MainActivity

android.intent.action.CHOOSER android.intent.action.MAIN android.intent.action.VIEW android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_CHANGED com.ui.OnAlarmReceiver.ACTION_WIDGET_RECEIVER com.android.vending.billing.InAppBillingService.COIN com.android.vending.billing.InAppBillingService.COIO com.android.vending.billing.InAppBillingService.LUCM com.android.vending.billing.InAppBillingService.PROX ir.cafebazaar.pardakht.InAppBillingService.BIND ru.aaaaaaax.installer com.nokia.payment.iapenabler.InAppBillingService.BIND com.android.vending.billing.InAppBillingService.INST

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rrzojqskyfdfuhyxioaxdqaufjocfjtxjxjfufmbyqinxcizvt20

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.FloatingView

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mtoxzfrorlizymrlaefteqfqfcvqgtassrinrtxwgfkncnyzpr4.CraxsBrowser

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.CameraActvity

bob.display.aug.xyz

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestScreenCap

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.SecondActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.WakeupActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestUninstall

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestInstallPrim

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.installupdate

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.flyActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.OpenActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.OpenChrome

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.nrxeqyeruwwlkfwxlgzindnfwztclkusycrtyykwilyhdztvhd22Over

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestDataUsage

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestVPN

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.oiosatdrmfeyovlqrcrfmbvmiexinftgrejgxqfwzgclynjukj29

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestOPPOB

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestPermission2

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestKeyboard

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.qriffccrtqaivilahtkxvfzthdxctakiiouarrjfzromtjbpnw21

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestAdmin

Android Permissions

Craxs rat mobile V1.apk

Permissions

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Craxs rat mobile V1.apk

File Signature issue

com.appd.instll.mowslhecvkzsajldwldwqhfikuqdhq2

com.appd.instll.vgevnuomavvggfaznxaaxohqlzteex3

com.appd.instll.splash

com.appd.instll.blnvfyobaecdointwqmmqixbmgkxvy4

androidx.core.content.FileProvider

childapp.apk

File Signature issue

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.MainActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rrzojqskyfdfuhyxioaxdqaufjocfjtxjxjfufmbyqinxcizvt20

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.FloatingView

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mtoxzfrorlizymrlaefteqfqfcvqgtassrinrtxwgfkncnyzpr4.CraxsBrowser

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.CameraActvity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestScreenCap

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.SecondActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.WakeupActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestUninstall

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestInstallPrim

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.installupdate

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.flyActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.OpenActivity

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.OpenChrome

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.nrxeqyeruwwlkfwxlgzindnfwztclkusycrtyykwilyhdztvhd22Over

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestDataUsage

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestVPN

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.oiosatdrmfeyovlqrcrfmbvmiexinftgrejgxqfwzgclynjukj29

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestOPPOB

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestPermission2

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestKeyboard

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.qriffccrtqaivilahtkxvfzthdxctakiiouarrjfzromtjbpnw21

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestAdmin

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.initializeService

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mtoxzfrorlizymrlaefteqfqfcvqgtassrinrtxwgfkncnyzpr4.CameraHandler

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.LocationService

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.AccessService

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.BackgroundWorker

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.vfvtjcghjkhamcygfzbeiomgttwryuaotahaqruvtgsiwutwoi38

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.FirewallServices

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mjabrawfyegoskqejkyntgxbfambbbriscwiecwafkgcqnnyrz27ture

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.MyJobService

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.KeyboardService

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.CustomReceiver

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.BootReceiver

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.PackagesReceiver

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.ScreenReceiver

bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.Datareciver

bob.display.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

Craxs rat mobile V1.apk