spynote | f4c595a107b277f901da24dd2a8f1d08036a45303f473e7b7b2713e625fc91d9

Resubmissions

02/07/2026, 19:36

260702-ybb29sh15r10

02/07/2026, 18:24

260702-w15prsb12110

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27-17.zip
Size 10.0MB
Sample260702-ybb29sh15r
SHA256 f4c595a107b277f901da24dd2a8f1d08036a45303f473e7b7b2713e625fc91d9
MD5 78a8037f9140b2e8d22baf90118784b0
SHA1 2ad64029efc03e656b8370112ca184221079cb9e
SHA512 b1595821daaae8e7918852dcff5a2cacbdd87fc8996da10112edd0a94a518bc9181ac1a15f6c39fa9d4d02aea15b1788e0b38795240e6e51d02545bc2ed3ce61
SSDEEP 196608:maNVKNkiY2rPAVAe7u9uRHaSncTG5bdhAkfdZOrXiUf7YRJ79:mavKuiY2rYVAOu9uR/nGIbdpUSDR
TLSH
T174B6332536AB79CBF5A89CFC823584A64B38035F1134E36FF470A2B4357EAB78554A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  125e9eecc725a29649a8adba3feea2fcb2d5077d1ab2f57fc8e6a2c82d4bda1e.elf
- Size 272KB
- SHA256 125e9eecc725a29649a8adba3feea2fcb2d5077d1ab2f57fc8e6a2c82d4bda1e
- MD5 ad4c957f61417d7a13eb7728dfa49c34
- SHA1 2d5d8a6c4085cc27bd301f89b3b9e118ede7d9cb
- SHA512 1fe0a453babb91adf360095804b23363c8a061b1e9bc37eed9cbe8b2b2e85a30948252fae932d7cf843c48a89dbdcca43046fc5b4d882fbcc9e85ac230063863
- SSDEEP 6144:qjpgw/FPItrquLwjxOLe0GYPNdP35FqYstse:vCULwNie0JNdP3HSye
- TLSH
  T12B442A22B57A1E1BC4C0E47662F74336F5F2BB461CFC891A7E615E8C6B6528071A33B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  2623f6dc0b4d56f7aaf634bd25d0baec6f14bf5d902bc2b75534b731667d7646.elf
- Size 394KB
- SHA256 2623f6dc0b4d56f7aaf634bd25d0baec6f14bf5d902bc2b75534b731667d7646
- MD5 c1ca49443991a6a79de7215dfabf53fd
- SHA1 195ad7fc4d70c6323392b702a2fcd2f68d026533
- SHA512 d9fbfaa2829ad855ed05ba4b88eb4a2917c590e01e4a3f819b7a66bd1596b11e4e47a423db348f98c149e37e59fb91167473678b28850e8f46ad0e86b9c09bbf
- SSDEEP 12288:YCv5I7Awtb+1t3ISvuQK3H4lXNgXYmoR1DnisYtz:BvWk+6wSvuQWrYmoR1Littz
- TLSH
  T1968413FDA5B3FAD2F103EF3402760DB45271679016D2FA46BFA4A568CA8870E7197231
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  2c3416d10a67021fa236a254bf397ece6789b921af0ef5f33b9ca69c63f6e6c2.elf
- Size 394KB
- SHA256 2c3416d10a67021fa236a254bf397ece6789b921af0ef5f33b9ca69c63f6e6c2
- MD5 91739f46454095f5a22b0db73bf9260e
- SHA1 351dbea81cf00f4019d8ad02e4a279ce3ac959e1
- SHA512 564ddfead5a4348ec9bc82c0c8bb056cd7e94e91fd748c06a577633171573099bcc6eca934c3899ad62695f96a47c6961ed0a010a38d0eb07e2b5f0a4482aa74
- SSDEEP 12288:iRh11RjyZnAtjOWgtNUj9SDeg3B+zSf4t:c4IaRtOj9s+zSgt
- TLSH
  T19784222BD1E97F63DC5BDCFA18E80DCA296BF7A31766CF03CB645ED0A01A2162564C50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  304e7db1072c78f322297554b1c8b7c8f40b017cebf2d5f009e04674e633d92a.elf
- Size 236KB
- SHA256 304e7db1072c78f322297554b1c8b7c8f40b017cebf2d5f009e04674e633d92a
- MD5 d22b33bc23a7c97a5945ce718e416f46
- SHA1 1ca2f6cbab1a5b0fba5578b549787190e91f7afa
- SHA512 bf1113198fdbd72b5c466653dfca21ff1dd3245c0e537f2d4c2a123551d25a198f4edbe31e3922c663c743a8c22b98c426441c5455eeafe764f2a5bc3ee2cb96
- SSDEEP 6144:Q/EDFp853nMt7u9BNypDIbMaZMrwSPz3E:Q/4Fp853nMxNpDIbvMlg
- TLSH
  T10C347D63D936AF96C022A8F4B1F2DF780F12BD6789071E99D576EAB08093DC9B501374
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  49061a4ad78f4891c747acff4fbb75b816635069625ea654f22f41810e2be45a.elf
- Size 377KB
- SHA256 49061a4ad78f4891c747acff4fbb75b816635069625ea654f22f41810e2be45a
- MD5 6dedc8ebc7b8919a68a4163c0c849455
- SHA1 cb770faff1d3b85118fd74b1a7c5f9edf849b08b
- SHA512 4ebbb30fe6af7bae58a8a959efb880cfd95e7fa04d1d285f331db24d19e09d6a2e3a818950a898c96af02aad75d10fd565a74437ca3ef9fa4a8d5069005b7dec
- SSDEEP 6144:bDkGfYHYGsVoidzivGYG3xekCMIvx5MwEw150IA+lngH8YFstGQxMfOY/rLEs4Vz:XkGfYHYG6lulkCXvx5yhIAeYqEQxMfO/
- TLSH
  T16084229C96900F7EF30B427959F70E385718A7A664529B82F709EDCCC82720DBC56379
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  547e1c8e530fc32219070e50c482870e87b452a50854ccc491cf5ab157527b44.elf
- Size 272KB
- SHA256 547e1c8e530fc32219070e50c482870e87b452a50854ccc491cf5ab157527b44
- MD5 c29b241bdb210ddfd89b087aa8db85af
- SHA1 b2b26a340dc455a0d2c7bdf3b678c5d79f6744c4
- SHA512 e3d3abf9e4c25357acd3d8cfad8c1b2b508c0c62c7dbd234d1c66b5cc0b37db7f1354d59b09e8f543db37ca60b1801482ff57c7d21fab4138b854516aef043fc
- SSDEEP 6144:1/2owZ/QovnR1eZZp4kc4xZllWE+LKF1LcdyVsJ3wX:1HwVvnRS7llHtjLLVrX
- TLSH
  T13D543A02BB0C0E03F1572EF0263B87F193DFA9A168B4B641695EBEC542B3C71E545AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  61b82406637f811d7f7191859f6ad1fe2be2af06370d1f1dcf9b500d45689a7d.elf
- Size 104KB
- SHA256 61b82406637f811d7f7191859f6ad1fe2be2af06370d1f1dcf9b500d45689a7d
- MD5 98c2dbbbf1c229471ee72a8363d97426
- SHA1 66413cf61303d7460ac7243c3357821a8b203c8c
- SHA512 ec19e986241f32e47f300375e2e6fcd7d64f58f406b905bfb2d11c4ee6a7da419ecef3a941efba7c3ec3ee265f923aafbbfca9e2d483fc4655e7966996ddb16a
- SSDEEP 1536:bYxAMeLsH8CdppwwL+vNNotwktVHcBIe93CI8zqeNKLep0C7urU6TIiNl5x8S0IK:bYJHfavNyeoI8ueILFU6TIiNaIryz
- TLSH
  T106B312E477A66FD8D8B24E31243242AC3115DDCA5786632D1E3E2CB4941EB532DF6246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  6dec293665c624ca094b8d312697a50d0e757deef68f3e5bd71bb80cf994036e.elf
- Size 268KB
- SHA256 6dec293665c624ca094b8d312697a50d0e757deef68f3e5bd71bb80cf994036e
- MD5 73da6329d37791005f8ed9632eaf6393
- SHA1 5543cdf0ba44f2ccc1b38c748af8618cabd3c94e
- SHA512 f0807938d84bf8fcdd97c317410a341d172f1c56197a31222232b0d501cb56cc237a6fd6d5243b62847c0feb89a1ad89518f770fbeadb636cd0248886d9688e8
- SSDEEP 6144:0Z0wsFsXof+Lf9smhLLl4JeAusERf6By2YFY:0JsF83vLl4MG4HFY
- TLSH
  T1D044085ABE419F17C6C216F7FBAD4288371A7BA8C6EE3113D8146F50379A48F0E36251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  71b203ab29d830edec1f478d7a4d9bd9dd6bbdf410ff70daf5b73d5cb1b26523.exe
- Size 3.4MB
- SHA256 71b203ab29d830edec1f478d7a4d9bd9dd6bbdf410ff70daf5b73d5cb1b26523
- MD5 df47ea7b4b581e1927406bbff062a245
- SHA1 de72fb8001d963326f9d647decfa8ad46f13af2b
- SHA512 8ff2710134c5e2d08c3593a8f16caaeb9cf46f5dd39c3a6db0984c0772e1ff6b37b21eb1930130794fb3ca35598c808f4ca2c18e12fbf5b1bfc185de35f4e77e
- SSDEEP 49152:vsVVDIjYgBJAED0KGk2LE0guLOIKYUGaZaXYNS2/YcNlfaEY1il:v2ImE0guL3gGaOYNnYcNfB
- TLSH
  T10BF59D47ACE14DF9C09A933089B7619A7B74BC480B3123D72E60B6B92EB33D45D36794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6.apk
- Size 4.4MB
- SHA256 b38d466dbb28feb20f4f8cc9d9a3b2204bf38e487e7cc5f057a756dd5f40b7c6
- MD5 8e408e3d592fa2bea942749408fa14c3
- SHA1 5d39d2b7a311054d9044135d33340d66fb2642ce
- SHA512 6fa413507aa7df9e0b3b9992855f88790d58245615031660cbb4114e26dbef57590bff2f986cbce82066ba1bf8a0cd6739213f49677a890823da96408c18b017
- SSDEEP 98304:Z1hFXASJ2Buoty9gvNnA7kUmzLzB/TV0tICxX+:rhprJquW9vi7kTzhqpo
- TLSH
  T10226F143FB45DA87D8AAC3F66F230D9919134F24C643AAE30461766E2E772D14DC6ACC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

banker collection credential_access defense_evasion discovery execution persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
behavioral10
- Target
  b3f96ec768b213ab4a61d0286491ba48a667b3a6746c6a662b6a16705162f8ca.elf
- Size 265KB
- SHA256 b3f96ec768b213ab4a61d0286491ba48a667b3a6746c6a662b6a16705162f8ca
- MD5 ea99f2b12040b9aedfb57311950217e4
- SHA1 397ab645aa02243d801a5ed7148e522f29231abd
- SHA512 2e97b9751df66a1d752f6fd9150d3ba112a8615eae35aadb5723fb947c152699f7f5d75edc54d9dd1952a0d6c9b96198fa0ee35cb32abbe96e7590cee1ff3be4
- SSDEEP 6144:InZ3s12sEB4cGWI1Uxe1ke4TAYw7BvFjAeSHQa3:IS12TB45q7e4Ts1aTQa3
- TLSH
  T1D0440856BE419F17C1D216B7FBAE4288371A7BA8C6EE3113D8146F94379A48F0E37241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  b7df3e2020c12c1359090dca42a5b341ce3609778711864ad79c19aafbe9487d.elf
- Size 280KB
- SHA256 b7df3e2020c12c1359090dca42a5b341ce3609778711864ad79c19aafbe9487d
- MD5 23ff57bf449de4239a22ace9b318f215
- SHA1 cc998a9f95a114c6a4f9c09c053cbf3f9e913930
- SHA512 dd142e629417c765422e3de3130f0ebdf3f43bf4447fd4efefde62abd2406068da2ea9a0f908e972ffc8be2851dae42eccd01f35cb0d992fa8fa8c61fa295b0d
- SSDEEP 6144:P5OJGge98Pv9SDoLA9Df4IB0wiX68ncraT6uVZkZ9p5C65Zpev:MPnSDoLMDgIu3XyraTMnp5C6Dp
- TLSH
  T133541916AD419F12C1D112FAFA6E828A33173FB8D2DE7212DD146FA4778A49F0E7B111
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  bf23faf4440b3ecf07ebc99d4961bae4274a68c0ee8bb35f1936fcb80284ef47.elf
- Size 259KB
- SHA256 bf23faf4440b3ecf07ebc99d4961bae4274a68c0ee8bb35f1936fcb80284ef47
- MD5 a736c0b9128212df18b435bc4d8556c9
- SHA1 00eaeead4afaaa1465db24367ffcd83e0a647167
- SHA512 55f00bfd5b1ea73737d4ec91aeaddcd254a485a9610767b75de0bee4340d1281556077469ca9c0674e7b26f1459198aa3de1eddb5c6460af9891ec59ebf6de5b
- SSDEEP 6144:Zy9dw+Q+l4FXeFutEV4EU1NvF7AGgp/LaRSQaeo85kYv9qrEiwoo4QnVe:kDIXeFutE+zhBA/LaRHaeLkYv9qIso4C
- TLSH
  T15F442819BE409F02C5D126FAFAAE829933577BB8D3EE7112E9145F64338A48F0F67141
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c.elf
- Size 5.6MB
- SHA256 caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c
- MD5 876fd318fdc34f99f4287b3d86790d9f
- SHA1 22b3f5db2854896dc5e1a41d24d8dff03ce54e79
- SHA512 4de5c64e17d4aafb4d3206ffc4d4f6caeea61390b4e2c4778076cd71016eee67a5260a590969aa150f0ebb618e9394338b49af45c2030f537930381f0fac8446
- SSDEEP 49152:42pVfZ03PyySNwWl3neuLayncJgzFtNd4yUkG730Qh5sL/Aah0WZHa5Ek:Xle3qySNpay5Hd4yG7wIdWdwEk
- TLSH
  T1D5563811FACB04F6E6031E3104BBA27F67315D064B25DBD7EB407E29FA7BA911936209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  cb573c8f6aaddb1c9ca8c77e996c01128b452ecc66518c5e24a01046925fb3ad.elf
- Size 94KB
- SHA256 cb573c8f6aaddb1c9ca8c77e996c01128b452ecc66518c5e24a01046925fb3ad
- MD5 88ce243fa186522369afbd6872b1288c
- SHA1 ea9a350f639f5336b0aa6b826c14a5d44387ba49
- SHA512 02fbed3946949265388987cd98ee74746a16cf600e0f457322e25727fd200533269ee423cf7f257447347ef41fb9456b9f3de669e79dfbf29640e1ee487f456c
- SSDEEP 1536:NjkamojCC895NqJYOvOCOSCdnJF/V3qwnjTcHQZPTnONng+3zcVHS2qhNf:NIt56V61RnnjZP7MghNSl3f
- TLSH
  T1779312E145655F1FF20B42727A2DAA0AD2D97A1D7456623F8B8406E0470030FE6BFF9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  f4abb11473d61da7c065a13069f797d4441d9718f5a218a5d6b5d00f2bf10682.elf
- Size 280KB
- SHA256 f4abb11473d61da7c065a13069f797d4441d9718f5a218a5d6b5d00f2bf10682
- MD5 6f0ecbdb8b67c2805a1e1057ad5ad13a
- SHA1 7044cdd0c92eb9eb298fa76dd92bac02cea1ca74
- SHA512 23f9a161b9dad2a1c7eeaad30a6d15286c69a54436b57add6ee4f457f5facf49a066dcd69d23478976d656b70bf0e61ae1578d3a0397938efe51eba541722ccb
- SSDEEP 6144:aPEUUpQ/LD54yWdlQxygBVF2aYHPc7jLN+c4iW:epjaHI+c4iW
- TLSH
  T1A1545B83F900CD7EF84BA377859349157030FB7608524A7AF2677DAADE3B0D61922E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16