spynote | f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7

user interaction
yes
max time kernel
16s
max time network
150s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
14/09/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7.apk
Size 8.7MB
Sample260914-mdfyfsbj4z
SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
MD5 12f5c6dd1ffdddab60d6da95216274e5
SHA1 77299594efea59d7c1d7a32fed95f35e24b8f874
SHA512 9f82fcc715ee6a8560e8092fe334e4e259d202fcb0f76c28134b2f1451bedc3f867bdace0e5d1ac5b739c642d395c4f915e89b016b9748ad229d2af07fce4e22
SSDEEP 196608:1VrMawyBMI8WszaGO/xohiP1V5C01VeeUK2zDr5Pqz8tW+:Xgawyx82GOJ4iPD1Ve9DrlXtW+
TLSH
T1BD96238EE3C98B5BCBEE4B7C4A36522312279E12575396BF8698F678143F1E40F548C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker spynote impact infostealer rat trojan

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_spynote
behavioral1/files/fstream-5.dat	family_spynote

Attempts to obfuscate APK file format 1 TTPs
Applies obfuscation techniques to the APK format in order to hinder analysis

Obfuscated Files or Information
T1406

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cosmos.scrubber.pupil

cosmos.scrubber.pupil
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:5055

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1406

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 8.2MB
SHA256 06d87d22601637e282a1c81a241fc77e105ae77023ea7476fc07f0f3aa6ee833
MD5 93926cbee6159a0a3b6b44931d78680f
SHA1 6cf7ff1959f416d23d5132084603f1343676590e
SHA512 c64ca5942a6bf9eae2e687df893cb4ffda6c1d4af99aa44bbaee34a74133d692686ce9c6b6ade02d766d0106951ab819068acbe8cd2c192ed03530f3d278a302
SSDEEP 196608:h0Ybz7OAcoPw5KR1V2tFFerG5d+jRNc8D3a8LNBoQD3rrXbh3nD:h0EBrP+q1eFQrWd03pNBoQPrbhz
TLSH
T16E86124BF788CB87D6AD83F96A3309A516232F05CB4216EB8254F77E2D3B1D10F95498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 1.7MB
SHA256 6ae1a2cff5238496d18f637a1a9849af56a4c0e3584adb06fe28c062c24a49e6
MD5 0f220eca2843b844f492610c5f96b2e1
SHA1 b832be6f6df2bcf146dad329f085b15b32c2acaa
SHA512 c87efd394974c19c87cfa2dbcf0dfdf10e896b5a4e2c514c6ba56b39a658b32166daf66a5bd0cf7950027ea459ff964106c9b076112f0e2bf24d8cbb223f1409
SSDEEP 49152:fZkg2H0cgToAYqTArQTOzmzN6qOic69OcoOFMn:i0tTAcTMmz7OiBWn
TLSH
T12385BF4BF3C89A9BD6FE4739497251661133AE628F5382ABD658F33C18372D04FA49D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 8.2MB
SHA256 73e29ba8dbcfb200425d97c07f90f51b69515b80dfde565ac36e0e109311e1d3
MD5 1f25f484275e94cb1236108020c5b3b5
SHA1 9d9eee27eced116baf9548050c865ca87d8b424a
SHA512 039eb99e0a31a1cafcdbf815afba8194844f33ced513bde6fbfdf67f71f4232acd04aeb555426fe1d37a3c9e1def9b295eb5047a4b3f3b943959330e3cb59790
SSDEEP 196608:LoPw5KR1V2tFFerG5d+jRNc8D3a8LNBoQD3rrXbh3nD:MP+q1eFQrWd03pNBoQPrbhz
TLSH
T18786224B9989DFC3E61C82F8BA130DE92E571B09C6512EFB4294EF9F3E085161DDA41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ۦۖ۫

Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
Size 8.0MB
SHA256 abefa69eaf00b4ac0807e82d430ff08d65241dba1badcce7f1dd04a002c057bf
MD5 bcce4b674b7af3409da3ecbb3dc10ec0
SHA1 7270e5129d1730d05767158bc6fb4af8085815f9
SHA512 369a92fc3d988286f7d600885a8365cff90767daee796edfb593876658eb47362ddf5feaa046fb7eae6c869e5193f81a0413c56afe3c2fe86e4b13d921f20824
SSDEEP 196608:cZyeXihM3JI+NmqVODWtD3sDM334jRVui5fC4HiOWsTVODxHyO/2O+cPNf:cZjHJrNFOoDcDo3Qf9C3sTgt/lNf
TLSH
T1AF8623C6E342889EC9FA4F34463A533122378C27D7578B979924F2B868336E42F95CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ۦۖ۫.

Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads