spynote | ready[.]apk

General

Target
ready.apk
Size 3.0MB
Sample260525-pqrltsa16w
SHA256 92a1324ad9b9dc18d005096b76628d94981591ada8585b5af83758572113a481
MD5 867789111895cd9560bb938b40df30f3
SHA1 a8e269ddd74089cb9f88374af5bcedcdf82a815b
SHA512 1f9c840f62473fd3531c773ef145676d62256503dd15f9098e20cd7f635fef90677d1dbbd52dc01cfc10caa9a043b13c5f39a274840b25fe3ddaa11190a9cf0b
SSDEEP 49152:rf5keOIeTnl+TuDm8As2mzPzdGGOQTOc1cUoYqe0cgw3PH8fMj6fK:zGpToTuiC2mzPzBhT7H0tw3Pyy
TLSH
T13CE5D003EB45CA9BD4FA83F56F270DA92A070F68CA42BAD704557A7E2E771C10DC568C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ready.apk

File Explorer

ready.apk

.apk 3.0MB

ready.apk

SHA256 92a1324ad9b9dc18d005096b76628d94981591ada8585b5af83758572113a481
MD5 867789111895cd9560bb938b40df30f3
SHA1 a8e269ddd74089cb9f88374af5bcedcdf82a815b
SHA512 1f9c840f62473fd3531c773ef145676d62256503dd15f9098e20cd7f635fef90677d1dbbd52dc01cfc10caa9a043b13c5f39a274840b25fe3ddaa11190a9cf0b
SSDEEP 49152:rf5keOIeTnl+TuDm8As2mzPzdGGOQTOc1cUoYqe0cgw3PH8fMj6fK:zGpToTuiC2mzPzBhT7H0tw3Pyy
TLSH
T13CE5D003EB45CA9BD4FA83F56F270DA92A070F68CA42BAD704557A7E2E771C10DC568C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

722927262d6837c35750ef163c6082464452aba0e5bfe6b5b9082f4f5242975a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

jason.trans.orgasm

Android Permissions

ready.apk

Permissions

android.permission.SEND_SMS

android.permission.SET_WALLPAPER

android.permission.READ_SMS

android.permission.READ_CALL_LOG

android.permission.READ_CONTACTS

android.permission.GET_ACCOUNTS

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CALL_PHONE

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Signatures

File Explorer

ready.apk

File Signature issue

jason.trans.yntrh2.MainActivity

jason.trans.yntrh2.RequestAccess

jason.trans.yntrh2.FloatingView

jason.trans.yntrh2.wfdss4.CraxsBrowser

jason.trans.yntrh2.CameraActvity

jason.trans.yntrh2.RequestScreenCap

jason.trans.yntrh2.SecondActivity

jason.trans.yntrh2.WakeupActivity

jason.trans.yntrh2.RequestUninstall

jason.trans.yntrh2.RequestInstallPrim

jason.trans.yntrh2.installupdate

jason.trans.yntrh2.flyActivity

jason.trans.yntrh2.OpenActivity

jason.trans.yntrh2.OpenChrome

jason.trans.yntrh2.RequestDrawOver

jason.trans.yntrh2.RequestDataUsage

jason.trans.yntrh2.RequestVPN

jason.trans.yntrh2.RequestPermissions

jason.trans.yntrh2.RequestOPPOB

jason.trans.yntrh2.RequestPermission2

jason.trans.yntrh2.RequestKeyboard

jason.trans.yntrh2.RequestBattery

jason.trans.yntrh2.RequestAdmin

jason.trans.yntrh2.vozfc3.initializeService

jason.trans.yntrh2.wfdss4.CameraHandler

jason.trans.yntrh2.vozfc3.LocationService

jason.trans.yntrh2.vozfc3.AccessService

jason.trans.yntrh2.vozfc3.BackgroundWorker

jason.trans.yntrh2.vozfc3.CommandsService

jason.trans.yntrh2.vozfc3.FirewallServices

jason.trans.yntrh2.StartScreenCapture

jason.trans.yntrh2.vozfc3.MyJobService

jason.trans.yntrh2.vozfc3.KeyboardService

jason.trans.yntrh2.zazvj5.CustomReceiver

jason.trans.yntrh2.zazvj5.BootReceiver

jason.trans.yntrh2.zazvj5.PackagesReceiver

jason.trans.yntrh2.zazvj5.ScreenReceiver

jason.trans.yntrh2.zazvj5.Datareciver

jason.trans.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

ready.apk