spynote | eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60[.]apk

General

Target
eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk
Size 813KB
Sample260702-2v4heags2z
SHA256 eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60
MD5 a51334ad82fbdbd4e2f1483b57eccf42
SHA1 00840f90c6860f840f138220a77c31db866fdcf4
SHA512 3af3ffd37e12aedec3ec30b5aeebf3a81060e1c14bee2f9ce79342d65b2c2481c2e7eca721d9731389c3b751ab0c68233d59d8817f6e437e87945f1fd6913873
SSDEEP 12288:WuypHdK2vxu5FbAE7DKcbN78blukHCnBh8vDHzL8qKB/A:Wuy3lxu53PlbN78bkkHCnBeDHsqKhA
TLSH
T187058D83F74BA866D5F3CB3642B9076A1A568C184747D7630A91B63C0DBF9C05B89FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk

File Explorer

eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk

.apk 813KB

eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk

SHA256 eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60
MD5 a51334ad82fbdbd4e2f1483b57eccf42
SHA1 00840f90c6860f840f138220a77c31db866fdcf4
SHA512 3af3ffd37e12aedec3ec30b5aeebf3a81060e1c14bee2f9ce79342d65b2c2481c2e7eca721d9731389c3b751ab0c68233d59d8817f6e437e87945f1fd6913873
SSDEEP 12288:WuypHdK2vxu5FbAE7DKcbN78blukHCnBh8vDHzL8qKB/A:Wuy3lxu53PlbN78bkkHCnBeDHsqKhA
TLSH
T187058D83F74BA866D5F3CB3642B9076A1A568C184747D7630A91B63C0DBF9C05B89FC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ca68c4627304bf2574f3bbc24fb44c92a6bddf9d585e7ef7d336f800469dba91

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

yps.eton.application

Android Permissions

eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk

Permissions

android.permission.READ_SMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.GET_ACCOUNTS

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_CONTACTS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_SMS

android.permission.RECEIVE_BOOT_COMPLETED

eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk

File Signature issue

yps.eton.application.M

yps.eton.application.h

yps.eton.application.A

yps.eton.application.F

yps.eton.application.G

yps.eton.application.k

yps.eton.application.B

yps.eton.application.C

yps.eton.application.S

yps.eton.application.Z

yps.eton.application.D

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk

File Signature issue

yps.eton.application.M

yps.eton.application.h

yps.eton.application.A

yps.eton.application.F

yps.eton.application.G

yps.eton.application.k

yps.eton.application.B

yps.eton.application.C

yps.eton.application.S

yps.eton.application.Z

yps.eton.application.D

Android Permissions

eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60.apk