spynote | youtube[.]lite_Dropper[.]apk

General

Target
youtube.lite_Dropper.apk
Size 7.3MB
Sample260612-xdm2wabv2w
SHA256 32098a3eef8873548d1de96df13d1c9da40fa6be788efd8dedd9658cd9325240
MD5 e329dacf468ea39bc42569f942cb9b9c
SHA1 725bf9d7ffbfb6dc37c70667508be93c54dff2c5
SHA512 1fa3a78097b8d513cf19e8414c192bb7c4766abc02adcd91c19178e150a0be72865ac477b8efe101b326ea9855bcc1a907ed766ca9c74e62fb47c7c2a48601a1
SSDEEP 196608:exIX9YVvJBY4gwpiX6ol2u379oFMSWRk/GP78TJ:dX9khBYj8iX6tnpk78V
TLSH
T11B762252FB06D82AC4E7C3374A3A46756A069C1D8693C78769D8723C4DBF9C04EDAEC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
static1/unpack001/childapp.apk	family_spynote

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
youtube.lite_Dropper.apk
unpack001/childapp.apk

File Explorer

youtube.lite_Dropper.apk

.apk 7.3MB
childapp.apk

.apk 4.4MB

youtube.lite_Dropper.apk

SHA256 32098a3eef8873548d1de96df13d1c9da40fa6be788efd8dedd9658cd9325240
MD5 e329dacf468ea39bc42569f942cb9b9c
SHA1 725bf9d7ffbfb6dc37c70667508be93c54dff2c5
SHA512 1fa3a78097b8d513cf19e8414c192bb7c4766abc02adcd91c19178e150a0be72865ac477b8efe101b326ea9855bcc1a907ed766ca9c74e62fb47c7c2a48601a1
SSDEEP 196608:exIX9YVvJBY4gwpiX6ol2u379oFMSWRk/GP78TJ:dX9khBYj8iX6tnpk78V
TLSH
T11B762252FB06D82AC4E7C3374A3A46756A069C1D8693C78769D8723C4DBF9C04EDAEC4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

3093fc0f9889212e687a4804f2432883e5ecb0243d6c2cb5e13fb78f9de6e1d2

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.appd.instll.load

childapp.apk

SHA256 d040ea6f737946babeaa20ec92e1bd8bf0b342f37019188426e5222597052d45
MD5 5fca3c4f8ec383fed2ba56ce29b39c83
SHA1 3f93ba867fba78f862876f9802109de9f043eae9
SHA512 3c0b5904ec2b9e3c62368d76635331dd19a0d6ff838177257977591c5e4222a0eb6d266f090136d4a083863801638573ca2c3cfb4e949a60f4a0864084cea3c3
SSDEEP 98304:XFLjWIJ1lFrDVxC/W/FYMqes8/L88mz4zBpTN0t4k1qN:oIvlsKZHL4zuCfq
TLSH
T1A226F103FB45CB97D8AA83F66F370DA92A134F14C6436AE70955762E2E772C10EC568C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

2abd17b16a74220ad1f4ec84ea7d2af710efe919f636fe7b831bb381e74e5171

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,OU=Android,O=US,L=US,ST=US,C=US

com.contract.app

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.MainActivity

android.intent.action.MAIN

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.isrjhroorjshhuhvaoyxhzihjosgyxaalfopwxsqtcaxyhmbzs20

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.FloatingView

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ymohvcbrknsnxeoujrdhblrwadynhwynfqzklncagrzgjnbnxk4.CraxsBrowser

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.CameraActvity

com.contract.app.xyz

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestScreenCap

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.SecondActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.WakeupActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestUninstall

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestInstallPrim

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.installupdate

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.flyActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.OpenActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.OpenChrome

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lbmvkgmomdnnhihblocwyefblihcjgesagwgjogdnbygtljrjx22Over

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestDataUsage

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestVPN

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.nucrjhkdaychvndkhathhfszajkutofqbnemdfxqktrjpsklgl29

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestOPPOB

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestPermission2

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestKeyboard

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.fgggyjcnlusrcshwnemydijbndqyawzbffmtgvisnvxfizqkgt21

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestAdmin

Android Permissions

youtube.lite_Dropper.apk

Permissions

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

youtube.lite_Dropper.apk

File Signature issue

com.appd.instll.kcwwipmoftedmvqvrladibriıuffwa2

com.appd.instll.wbzgznıwzetlhlvıcvqtqkgnneoddz3

com.appd.instll.splash

com.appd.instll.bcmrcnxxcchxkımklrrqflfnpxafim4

androidx.core.content.FileProvider

childapp.apk

File Signature issue

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.MainActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.isrjhroorjshhuhvaoyxhzihjosgyxaalfopwxsqtcaxyhmbzs20

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.FloatingView

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ymohvcbrknsnxeoujrdhblrwadynhwynfqzklncagrzgjnbnxk4.CraxsBrowser

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.CameraActvity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestScreenCap

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.SecondActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.WakeupActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestUninstall

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestInstallPrim

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.installupdate

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.flyActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.OpenActivity

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.OpenChrome

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lbmvkgmomdnnhihblocwyefblihcjgesagwgjogdnbygtljrjx22Over

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestDataUsage

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestVPN

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.nucrjhkdaychvndkhathhfszajkutofqbnemdfxqktrjpsklgl29

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestOPPOB

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestPermission2

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestKeyboard

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.fgggyjcnlusrcshwnemydijbndqyawzbffmtgvisnvxfizqkgt21

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.RequestAdmin

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.initializeService

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ymohvcbrknsnxeoujrdhblrwadynhwynfqzklncagrzgjnbnxk4.CameraHandler

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.LocationService

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.AccessService

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.BackgroundWorker

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.tiioyslylawbjfcuduydnfhcaxjywhxvgxwusxnoltefbuxqqj38

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.FirewallServices

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.umcahpnqwnqdjkepksicqyrivivsooegfsfdidyvvmkymgdmro27ture

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.MyJobService

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.lrnkvbkuoyhwwjjclyatabmdqjrxgnnkcjvzuleormlwhiwnjt3.KeyboardService

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ajfzohvjgwjouuagessauzaxzxmirruovuzkddzvvswwcyyfte5.CustomReceiver

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ajfzohvjgwjouuagessauzaxzxmirruovuzkddzvvswwcyyfte5.BootReceiver

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ajfzohvjgwjouuagessauzaxzxmirruovuzkddzvvswwcyyfte5.PackagesReceiver

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ajfzohvjgwjouuagessauzaxzxmirruovuzkddzvvswwcyyfte5.ScreenReceiver

com.contract.vhasjbytsejmchjytybqaiucxsovcftvkngegomeqdvgmgvqzg2.ajfzohvjgwjouuagessauzaxzxmirruovuzkddzvvswwcyyfte5.Datareciver

com.contract.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

youtube.lite_Dropper.apk