spynote | ready[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
ready.apk
Size 5.7MB
Sample260511-skexmacz91
SHA256 768bbd2b553c108b62b71de80c53ec696f1aae8eaacbef5fd25ffc208357d21d
MD5 a48ce8eb6e48866d5505be3fc889a69d
SHA1 2e4ae77423e4c6ba4e5001a791de26d2c0619c4a
SHA512 8632a29031947f9166abe8d97eb154005835123a65d64c89b77b754d601bec4b89b054717c77d7357cbae7e515f8e75134990e3d5239b71adfa9d4ac541b08cd
SSDEEP 49152:wotVKE48k3xvSPNrzuoRIjBhFvqmGkCMemzAzdGGfQTOE3ULYqR0cgQOCyik3gJ:X4rMluoRcBPvqmGUemzAzB4Tg0tQOhgJ
TLSH
T15456DF03FB45CADAD8AA93F16F634FA91A130F05C642AAE74465367E2E771C10DC5ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Extracted

Family

spynote

xotsdro0dc.localto.net:9014

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ready.apk

File Explorer

ready.apk

.apk 5.7MB

ready.apk

SHA256 768bbd2b553c108b62b71de80c53ec696f1aae8eaacbef5fd25ffc208357d21d
MD5 a48ce8eb6e48866d5505be3fc889a69d
SHA1 2e4ae77423e4c6ba4e5001a791de26d2c0619c4a
SHA512 8632a29031947f9166abe8d97eb154005835123a65d64c89b77b754d601bec4b89b054717c77d7357cbae7e515f8e75134990e3d5239b71adfa9d4ac541b08cd
SSDEEP 49152:wotVKE48k3xvSPNrzuoRIjBhFvqmGkCMemzAzdGGfQTOE3ULYqR0cgQOCyik3gJ:X4rMluoRcBPvqmGUemzAzB4Tg0tQOhgJ
TLSH
T15456DF03FB45CADAD8AA93F16F634FA91A130F05C642AAE74465367E2E771C10DC5ACC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

5ca1de1b85c29856f5b597d53e8899f4aef7387f15825944c4070373d0c61676

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.tv.service

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6SJTMB87

android.intent.action.MAIN

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6GqoLQ101

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6kYlJO67

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6bxqkG55

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6XVLHn31

com.tv.service.xyz

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6utYfS119

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6kaIad128

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6CYdNZ140

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6uMxDX120

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6druGV111

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6WiPZq73

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6CWhPr69

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6fFmxI93

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6ocDMs94

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6KosYj109

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6EPUZu106

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6vMTZQ121

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6VVBQl118

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6JsOfG116

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6NgOaV117

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6bKMLn114

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6jlxqP103

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6fixnS102

Android Permissions

ready.apk

Permissions

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ready.apk

File Signature issue

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6SJTMB87

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6GqoLQ101

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6kYlJO67

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6bxqkG55

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6XVLHn31

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6utYfS119

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6kaIad128

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6CYdNZ140

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6uMxDX120

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6druGV111

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6WiPZq73

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6CWhPr69

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6fFmxI93

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6ocDMs94

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6KosYj109

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6EPUZu106

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6vMTZQ121

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6VVBQl118

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6JsOfG116

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6NgOaV117

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6bKMLn114

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6jlxqP103

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6fixnS102

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6aEgDk72

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6eVKQk35

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6dRFVL76

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6nSsAP24

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6NVnDQ28

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6zrxWI48

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6yVghL62

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6sltWG132

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6icJWw90

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6njgBS74

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6gcmZn57

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6xTPit30

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6mshyY96

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6OYega123

com.tv.knzsirkvbltdhvzziftlsifenfqsoejmyynnqvurgsshmcclnj2.ygtdxyvkknanewhgfıljhcjahuaswvetvatyqzsfglquxetjlc6oBnVr59

com.tv.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

ready.apk