spynote | ready[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
ready.apk
Size 4.7MB
Sample260510-tym1tsbx4t
SHA256 617f32aebe23ab199b1e61742cc1fcc00960abf767f82177ae35d43789e611af
MD5 2f037d9e75a0949d771ec7609d96cc63
SHA1 3c6f537ebb3d387476374df10e4ae88ac3d4865d
SHA512 39983f197cffcb57693d8d1fe57b7352f1a72ddc39ea39258bb8e0de926104bbdeaa14a4ea529ef050f4b1d8d78a0eaaded1bbd5bf9d25fe18bf7a49ac83e158
SSDEEP 49152:FHUANOPIBJoiyzP2y0qxqfBpwB/+zrngSr9lmmzbzdGGOQTOcPULYqZ0cgIv8LiJ:F0GxBJo11DT+zz7ZlmmzbzBhTO0tIv9P
TLSH
T15736E043FB84DA9AD8BD83B56F730FA91A130F15C642AAD704543A6E2E771C10ED5ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Extracted

Family

spynote

67xvo0mp1s.localto.net:9667

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ready.apk

File Explorer

ready.apk

.apk 4.7MB

ready.apk

SHA256 617f32aebe23ab199b1e61742cc1fcc00960abf767f82177ae35d43789e611af
MD5 2f037d9e75a0949d771ec7609d96cc63
SHA1 3c6f537ebb3d387476374df10e4ae88ac3d4865d
SHA512 39983f197cffcb57693d8d1fe57b7352f1a72ddc39ea39258bb8e0de926104bbdeaa14a4ea529ef050f4b1d8d78a0eaaded1bbd5bf9d25fe18bf7a49ac83e158
SSDEEP 49152:FHUANOPIBJoiyzP2y0qxqfBpwB/+zrngSr9lmmzbzdGGOQTOcPULYqZ0cgIv8LiJ:F0GxBJo11DT+zz7ZlmmzbzBhTO0tIv9P
TLSH
T15736E043FB84DA9AD8BD83B56F730FA91A130F15C642AAD704543A6E2E771C10ED5ACC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9a0b7d8a2afe007cbe5c3b86eec58c731efc03fc70098c7f089c69e657f7072a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.nex.service

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6SJTMB87

android.intent.action.MAIN

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6GqoLQ101

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6kYlJO67

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6bxqkG55

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6XVLHn31

com.nex.service.xyz

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6utYfS119

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6kaIad128

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6CYdNZ140

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6uMxDX120

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6druGV111

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6WiPZq73

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6CWhPr69

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6fFmxI93

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6ocDMs94

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6KosYj109

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6EPUZu106

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6vMTZQ121

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6VVBQl118

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6JsOfG116

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6NgOaV117

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6bKMLn114

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6jlxqP103

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6fixnS102

Android Permissions

ready.apk

Permissions

android.permission.READ_SMS

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ready.apk

File Signature issue

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6SJTMB87

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6GqoLQ101

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6kYlJO67

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6bxqkG55

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6XVLHn31

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6utYfS119

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6kaIad128

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6CYdNZ140

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6uMxDX120

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6druGV111

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6WiPZq73

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6CWhPr69

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6fFmxI93

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6ocDMs94

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6KosYj109

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6EPUZu106

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6vMTZQ121

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6VVBQl118

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6JsOfG116

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6NgOaV117

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6bKMLn114

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6jlxqP103

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6fixnS102

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6aEgDk72

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6eVKQk35

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6dRFVL76

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6nSsAP24

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6NVnDQ28

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6zrxWI48

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6yVghL62

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6sltWG132

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6icJWw90

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6njgBS74

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6gcmZn57

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6xTPit30

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6mshyY96

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6OYega123

com.nex.uotqnjayktlaxxyıgjzyhkzktdnuawzsfvıvgnddfwmrsegrli2.zexjwqguofwnfxnxbnniivcoshmsogahwyosfcıbazlkhhcgmd6oBnVr59

com.nex.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

ready.apk