spynote | final[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
final.apk
Size 5.8MB
Sample260528-radfdaa17s
SHA256 9ac3b20234d02467356b68bf3c5d2858f8f72654d2b47542ac8650d06312ce1c
MD5 579a35c1a965901e4bdac4032bb4eef3
SHA1 81e97f583918f1e7caa92354a4dd0129d16a437e
SHA512 11765b40765a3177fb58f0034d87f56d44b1a012222ada1a8dddb5549f00929e3c0add1c1ba762c7d2fa427443a4af8bb4cdd3b9f4f13644b4c7c9517b44d06e
SSDEEP 98304:Lwof7dMbrkLfhsdhl9c2ROUb2759+LL+1KmzOaLEZKpEzB6c0m0NL0t:nj6oLJsdrTRHM+LLwlzOaLEZ2A
TLSH
T116560203EB49DAD7E8A9C3F26F630D951A570F18D642ABD705217AAD2E770C50EC1ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
final.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
final.apk

File Explorer

final.apk

.apk 5.8MB

final.apk

SHA256 9ac3b20234d02467356b68bf3c5d2858f8f72654d2b47542ac8650d06312ce1c
MD5 579a35c1a965901e4bdac4032bb4eef3
SHA1 81e97f583918f1e7caa92354a4dd0129d16a437e
SHA512 11765b40765a3177fb58f0034d87f56d44b1a012222ada1a8dddb5549f00929e3c0add1c1ba762c7d2fa427443a4af8bb4cdd3b9f4f13644b4c7c9517b44d06e
SSDEEP 98304:Lwof7dMbrkLfhsdhl9c2ROUb2759+LL+1KmzOaLEZKpEzB6c0m0NL0t:nj6oLJsdrTRHM+LLwlzOaLEZ2A
TLSH
T116560203EB49DAD7E8A9C3F26F630D951A570F18D642ABD705217AAD2E770C50EC1ACC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Codesign digest Mismatch

File was altered after it was signed.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

8d2e398dd272f51e8562611e516939451dbbb2f353e67bc943960ec403289c00

Digest Algorithm

sha256

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Global Digital Security Solutions Inc,OU=Mobile Technologies Division,O=GDSS,L=Wilmington,ST=Delaware,C=US

Chains

May 27, 2026

CN=Global Digital Security Solutions Inc,OU=Mobile Technologies Division,O=GDSS,L=Wilmington,ST=Delaware,C=US

build.ledear.fvxfk

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.MainActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.SmsManagerActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.NewSMSActivity

android.intent.action.SEND android.intent.action.SENDTO

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ssiuwvwqcjkatwuqkjxfarepdwwwrdyesjfowkzbstknexoslp20

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cahggetaxryuvjhdbdrqpziinullbhqndztbmekhhrgqyqbikk2914

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.FloatingView

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cilqvngiounvicrdzwkckioyymxjolxskpomigsebenqhywgkn4.CraxsBrowser

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.CameraActvity

build.ledear.fvxfk.xyz

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestScreenCap

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.SecondActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.WakeupActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.MuteActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestUninstall

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestInstallPrim

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.installupdate

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.flyActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.OpenActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.OpenChrome

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.csvszlcmkeedzvudjsugiijauybvcqhuqwhqgqdrelznruslfl22Over

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestDataUsage

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestVPN

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cahggetaxryuvjhdbdrqpziinullbhqndztbmekhhrgqyqbikk29

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestOPPOB

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestPermission2

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestKeyboard

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.lpvwmmkivldlyawhknnjklyheggbjqepxfdhjqlhqefseskjgy21

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestAdmin

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.initializeService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cilqvngiounvicrdzwkckioyymxjolxskpomigsebenqhywgkn4.CameraHandler

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.LocationService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.AccessService

android.accessibilityservice.AccessibilityService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.BackgroundWorker

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.vjetnnrxcbojndshkajhzoiwrraljymazojwzltzdambaqpqot38

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.FirewallServices

android.net.VpnService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.HeadlessSmsSendService

android.intent.action.RESPOND_VIA_MESSAGE

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.symhxpztwcmsgkoymcmrmbkqqlsjjmsccdmtixiqaebinsdupd27ture

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.MyJobService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.KeyboardService

android.view.InputMethod

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.CustomReceiver

build.ledear.fvxfk.RestartSensor

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.ACTION_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.LOCKED_BOOT_COMPLETED miui.intent.action.BOOT_COMPLETEDT

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.NewSmsReceiver

android.provider.Telephony.SMS_DELIVER

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.PackagesReceiver

android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_CHANGED android.intent.action.MY_PACKAGE_REPLACED

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.ScreenReceiver

android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.USER_PRESENT

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.Datareciver

android.intent.action.DATE_CHANGED

build.ledear.AdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED

Android Permissions

final.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Signatures

File Explorer

final.apk

File Signature issue

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.MainActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.SmsManagerActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.NewSMSActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ssiuwvwqcjkatwuqkjxfarepdwwwrdyesjfowkzbstknexoslp20

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cahggetaxryuvjhdbdrqpziinullbhqndztbmekhhrgqyqbikk2914

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.FloatingView

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cilqvngiounvicrdzwkckioyymxjolxskpomigsebenqhywgkn4.CraxsBrowser

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.CameraActvity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestScreenCap

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.SecondActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.WakeupActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.MuteActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestUninstall

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestInstallPrim

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.installupdate

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.flyActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.OpenActivity

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.OpenChrome

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.csvszlcmkeedzvudjsugiijauybvcqhuqwhqgqdrelznruslfl22Over

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestDataUsage

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestVPN

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cahggetaxryuvjhdbdrqpziinullbhqndztbmekhhrgqyqbikk29

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestOPPOB

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestPermission2

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestKeyboard

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.lpvwmmkivldlyawhknnjklyheggbjqepxfdhjqlhqefseskjgy21

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.RequestAdmin

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.initializeService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.cilqvngiounvicrdzwkckioyymxjolxskpomigsebenqhywgkn4.CameraHandler

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.LocationService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.AccessService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.BackgroundWorker

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.vjetnnrxcbojndshkajhzoiwrraljymazojwzltzdambaqpqot38

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.FirewallServices

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.HeadlessSmsSendService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.symhxpztwcmsgkoymcmrmbkqqlsjjmsccdmtixiqaebinsdupd27ture

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.MyJobService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.ibjktbxkyaznmkvlthlhjwqloukjaenmbylwzyurqloeplgnka3.KeyboardService

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.CustomReceiver

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.BootReceiver

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.NewSmsReceiver

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.MmsReceiver

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.PackagesReceiver

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.ScreenReceiver

build.ledear.qdqnckphnskpoklnucahafazzeueiinkgelekbdwndgdqmgone2.mcjbwtlrfhvmkotvgmvbvblyuyskoqhhkxzifcmvivzbmjruts5.Datareciver

build.ledear.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

final.apk