spynote | son_test[.]apk

Resubmissions

05/05/2026, 15:13

260505-slyfcsay5w

05/05/2026, 14:59

260505-sc9f9set9m10

05/05/2026, 14:09

260505-rf9e1adw5n10

Sharing

Copy URL Twitter E-mail

General

Target
son_test.apk
Size 3.7MB
Sample260505-slyfcsay5w
SHA256 6cd32a3f1e1f3bae31deb391c5b5eadc1a6bf554d555cc83af921c15647967a6
MD5 5a35bd151cfc9ce383cfeb7dd3b79f6a
SHA1 a11ff33dd851fb0fa7550261fca4b9e1927f17aa
SHA512 e23222a0d2df99112561bea5949b77494c3bb9f7ce4b41551b8849da5a064197461f9fead8d3b9fe28755b7f641b154508055f86a0ad5100543c43eb2ed791aa
SSDEEP 49152:FoR5I77LVdYi46dfnl82OxiX9YOKj6CmZmzkzdGG1QTOKCU1YqD0cgMFHe8Ygm13:FXVdbvl82OxiX1mzkzBaTr0tM1ed3
TLSH
T11806E003FB49DADBD8BA83F16B630CA92A134F19C642ABD704153A3D6E771C10DC5A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
son_test.apk

File Explorer

son_test.apk

.apk 3.7MB

son_test.apk

SHA256 6cd32a3f1e1f3bae31deb391c5b5eadc1a6bf554d555cc83af921c15647967a6
MD5 5a35bd151cfc9ce383cfeb7dd3b79f6a
SHA1 a11ff33dd851fb0fa7550261fca4b9e1927f17aa
SHA512 e23222a0d2df99112561bea5949b77494c3bb9f7ce4b41551b8849da5a064197461f9fead8d3b9fe28755b7f641b154508055f86a0ad5100543c43eb2ed791aa
SSDEEP 49152:FoR5I77LVdYi46dfnl82OxiX9YOKj6CmZmzkzdGG1QTOKCU1YqD0cgMFHe8Ygm13:FXVdbvl82OxiX1mzkzBaTr0tM1ed3
TLSH
T11806E003FB49DADBD8BA83F16B630CA92A134F19C642ABD704153A3D6E771C10DC5A9C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ac1f4c75eeb8df3f49512b749a144f622114a2ef2f5e4078a3ff0e15bef42d2c

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.android.vending

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6SJTMB87

android.intent.action.CHOOSER android.intent.action.MAIN android.intent.action.VIEW android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_CHANGED com.ui.OnAlarmReceiver.ACTION_WIDGET_RECEIVER com.android.vending.billing.InAppBillingService.COIN com.android.vending.billing.InAppBillingService.COIO com.android.vending.billing.InAppBillingService.LUCM com.android.vending.billing.InAppBillingService.PROX ir.cafebazaar.pardakht.InAppBillingService.BIND ru.aaaaaaax.installer com.nokia.payment.iapenabler.InAppBillingService.BIND com.android.vending.billing.InAppBillingService.INST

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6GqoLQ101

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6kYlJO67

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6bxqkG55

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6XVLHn31

com.android.vending.xyz

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6utYfS119

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6kaIad128

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6CYdNZ140

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6uMxDX120

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6druGV111

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6WiPZq73

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6CWhPr69

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6fFmxI93

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6ocDMs94

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6KosYj109

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6EPUZu106

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6vMTZQ121

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6VVBQl118

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6JsOfG116

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6NgOaV117

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6bKMLn114

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6jlxqP103

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6fixnS102

Android Permissions

son_test.apk

Permissions

android.permission.SEND_SMS

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

son_test.apk

File Signature issue

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6SJTMB87

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6GqoLQ101

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6kYlJO67

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6bxqkG55

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6XVLHn31

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6utYfS119

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6kaIad128

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6CYdNZ140

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6uMxDX120

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6druGV111

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6WiPZq73

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6CWhPr69

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6fFmxI93

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6ocDMs94

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6KosYj109

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6EPUZu106

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6vMTZQ121

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6VVBQl118

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6JsOfG116

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6NgOaV117

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6bKMLn114

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6jlxqP103

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6fixnS102

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6aEgDk72

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6eVKQk35

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6dRFVL76

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6nSsAP24

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6NVnDQ28

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6zrxWI48

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6yVghL62

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6sltWG132

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6icJWw90

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6njgBS74

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6gcmZn57

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6xTPit30

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6mshyY96

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6OYega123

com.android.srbgyqlctochxzeqqdwdcktmytkhecjthepvfiqnfnzenajrub2.cgkwnfucnhoujfjjdhlhvtuyvpznenxjphlyhysgporpeegiws6oBnVr59

com.android.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

son_test.apk