260615-r6yfesey4l_pw_infected.zip
- SHA256 00c05eef61f18312ac3e02ca048577e05eb5833a374605500a4961ccaa2e4a07
Password
infected
Behavioral task
behavioral1
Sample
Blockchain.apk
Resource
android-x86-arm-20260325-en
android-9-x86
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
Blockchain.apk
Resource
android-x64-20260325-en
android-10-x64
6 signatures
900 seconds
Behavioral task
behavioral3
Sample
Blockchain.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
5 signatures
900 seconds
General
- Target 260615-r6yfesey4l_pw_infected.zip
- Size 3.6MB
- Sample260615-sdfwcaez2j
- SHA256 00c05eef61f18312ac3e02ca048577e05eb5833a374605500a4961ccaa2e4a07
- MD5 56bfe836a62111f854cb52e52c18a5ce
- SHA1 39ed9f17d1215d7d8e1e68913721d93122d4224f
- SHA512 ff0be5599919249293e328a6cbbe8e8ea8b088680365e92fddcbd1d41e460b05a7511de1e1276245e2daffb20efba6cc1868eb40d44ce6f21b5922faf37d68aa
- SSDEEP 98304:dqwIJUkZjbZoIIXrRxer1S3r5BTyKlIhvK48Ky2VzBOU0yoA0L:YwiUeerDeS7n4v32lykL
- TLSH T1810633A4DEC0F89B7C17A4A4DECE2519C133864A55476482D5F1DB8FBCAD8D31A3A233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
- Spynote payload 1 IoCs
resource yara_rule static1/unpack001/Blockchain.apk family_spynote - Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 3 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD - Requests dangerous framework permissions 15 IoCs
description ioc Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to read the user's call log. android.permission.READ_CALL_LOG Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Required to be able to access the camera device. android.permission.CAMERA Allows an application to record audio. android.permission.RECORD_AUDIO Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Blockchain.apk
File Explorer
-
260615-r6yfesey4l_pw_infected.zip.zip 3.6MB
-
Blockchain.apk.apk 4.4MB
Blockchain.apk
- SHA256 091bae0fade92d4c3e4692473f1c9923b546850d12dd66355354bad39400164d
- MD5 9b2e258af5b612a4a53acb297d1e7d5f
- SHA1 b77763db3dd8b96601c60c06724d45ac7f4048c5
- SHA512 4891665885c4edf323ee4cd207a64ee377c58eebc922334bc9faee8e0a5cb7d22624d26a375176147dbc7feef73d2866ee37cccfaf882cc9e2e19adf944f5baf
- SSDEEP 98304:KNe++fOq8NWLPfK1IY7O+sVhRCVRzmzrzBRTV0t4yrke:KNe+OucLn07DsVKHyzjqJ3
- TLSH T1B4260203FB45D687D8AA93F66F230DA91A130F54C603BBE34461BA6D2D772D14DC6A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Spynote payload
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
File Signature issue
Digest
6c78d7c2eef34f31c8b00a0478bdf5914ac2592d3b503dfa7772b831953858f4
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=Android Debug,OU=Android,O=US,L=US,ST=US,C=US
Subject
CN=Android Debug,OU=Android,O=US,L=US,ST=US,C=US
Serial Number
05:6c:1a:15
Issuer
CN=Android Debug,OU=Android,O=US,L=US,ST=US,C=US
Timespan
Oct 23, 2016 - Mar 10, 2044
com.elect.di
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.MainActivity
android.permission.SEND_SMS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
oppo.permission.OPPO_COMPONENT_SAFE
oplus.permission.OPLUS_COMPONENT_SAFE
com.huawei.permission.external_app_settings.USE_COMPONENT
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.MainActivity
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.zgozvdaumbithjiidvaegtdxzaebjockkvfsyahfskbodtvjcj20
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.FloatingView
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.ikdveueesncetizdsovdwjoqijrojicxahikmgqliknocqeijk4.CraxsBrowser
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.CameraActvity
com.elect.di.xyz
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestScreenCap
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.SecondActivity
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.WakeupActivity
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestUninstall
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestInstallPrim
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.installupdate
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.flyActivity
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.OpenActivity
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.OpenChrome
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.kerygyntayhkjrmgeoifxkobudxydrheyburzyvfzxhywqwnvm22Over
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestDataUsage
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestVPN
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.crmzmsyqcjqbruhjkmhpiynjmoonabugqiqruccxvmajfdmhyv29
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestOPPOB
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestPermission2
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestKeyboard
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.kgwwebxnlfatokxoywrnseihahocoyyteqqmnuxmooaechlhnr21
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.RequestAdmin
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.initializeService
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.ikdveueesncetizdsovdwjoqijrojicxahikmgqliknocqeijk4.CameraHandler
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.LocationService
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.AccessService
android.accessibilityservice.AccessibilityService
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.BackgroundWorker
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.vxcwyoltbayevltjydbgfmhxfxrbdvcedbrfjeutuebaacpxyi38
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.FirewallServices
android.net.VpnService
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.gqwjmotalmkfgdkahhiawknvnfbwzonwrdzxkfnbfsxkwchpjl27ture
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.MyJobService
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.izslnugibofsewfchgnsgwkoulrdrnjwlcnzwkhncjuoskhsxn3.KeyboardService
android.view.InputMethod
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.nuukgzlebtcdtcdzsmpxvyigvealhmtgwkwytwwjoblghgrcyx5.CustomReceiver
com.elect.di.RestartSensor
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.nuukgzlebtcdtcdzsmpxvyigvealhmtgwkwytwwjoblghgrcyx5.BootReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.ACTION_BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT
android.intent.action.LOCKED_BOOT_COMPLETED
miui.intent.action.BOOT_COMPLETEDT
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.nuukgzlebtcdtcdzsmpxvyigvealhmtgwkwytwwjoblghgrcyx5.PackagesReceiver
android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
android.intent.action.MY_PACKAGE_REPLACED
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.nuukgzlebtcdtcdzsmpxvyigvealhmtgwkwytwwjoblghgrcyx5.ScreenReceiver
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.USER_PRESENT
com.elect.ttxjwgufnyngkzawfubjkjorxxabsgsrkdfkbeiyakchqgvlym2.nuukgzlebtcdtcdzsmpxvyigvealhmtgwkwytwwjoblghgrcyx5.Datareciver
android.intent.action.DATE_CHANGED
com.elect.AdminReceiver
android.app.action.DEVICE_ADMIN_ENABLED