Overview

overview

10

Static

static

10

standoff 2.apk

android-11-x64

7

standoff 2.apk

android-13-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    standoff 2.apk
  • Size 760KB
  • Sample260715-2rf8psax61
  • SHA256 348b84d12e8ec9d84a2cc48f0050782aafdd6d4e980ea3f9faea485bd7709f0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bankertrojaninfostealerratspynote

Malware Config

Extracted

Family

  • spynote

C2

  • 61qusahrad.localto.net:7642

Signatures

  • Family: Spynote

    Spynote is a Remote Access Trojan first seen in 2017.

    bankertrojaninfostealerratspynote
  • Spynote payload 1 IoCs
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 18 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • standoff 2.apk
    .apk 760KB

standoff 2.apk

  • SHA256 348b84d12e8ec9d84a2cc48f0050782aafdd6d4e980ea3f9faea485bd7709f0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • Spynote payload

  • Codesign digest Mismatch

    File was altered after it was signed.

  • Insecure Codesign Algorithm

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
d603a1573624ec826267e4d2e54e89d142245a49
Digest Algorithm
sha1
Digest Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Benim ismim,OU=Benim Firmam,O=Benim Firmam,L=Antan,ST=SANANE,C=rb,1.2.840.113549.1.9.1=#0c0f736168746540676d61696c2e636f6d
Chains

Jan 1, 0001

cmf0.c3b5bm90zq.patch

Android Permissions

standoff 2.apk

Permissions

android.permission.FLASHLIGHT

android.permission.CAMERA

android.permission.BLUETOOTH

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_CALL_LOG

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SET_WALLPAPER

android.permission.SET_WALLPAPER_HINTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.VIBRATE

android.permission.CAMERA

android.permission.GET_ACCOUNTS

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_CONTACTS

android.permission.READ_CONTACTS

android.permission.RECORD_AUDIO

android.permission.READ_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_CALL_LOG

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.RECEIVE_SMS

android.permission.GET_TASKS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.BROADCAST_PACKAGE_ADDED

android.permission.BROADCAST_PACKAGE_CHANGED

android.permission.BROADCAST_PACKAGE_INSTALL

android.permission.BROADCAST_PACKAGE_REPLACED

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.majeur.launcher.permission.UPDATE_BADGE

com.huawei.android.launcher.permission.CHANGE_BADGE

com.huawei.android.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_APP_BADGE

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS