spynote | f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7

max time kernel
3s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
14/09/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7.apk
Size 8.7MB
Sample260914-sqfq4sbd77
SHA256 f898162fbf7655f6e0c64ab0b50e4c76d62d1e013687fa2d9302d2f68973cef7
MD5 12f5c6dd1ffdddab60d6da95216274e5
SHA1 77299594efea59d7c1d7a32fed95f35e24b8f874
SHA512 9f82fcc715ee6a8560e8092fe334e4e259d202fcb0f76c28134b2f1451bedc3f867bdace0e5d1ac5b739c642d395c4f915e89b016b9748ad229d2af07fce4e22
SSDEEP 196608:1VrMawyBMI8WszaGO/xohiP1V5C01VeeUK2zDr5Pqz8tW+:Xgawyx82GOJ4iPD1Ve9DrlXtW+
TLSH
T1BD96238EE3C98B5BCBEE4B7C4A36522312279E12575396BF8698F678143F1E40F548C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker spynote impact infostealer rat trojan

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_spynote
behavioral1/files/fstream-5.dat	family_spynote

Attempts to obfuscate APK file format 1 TTPs
Applies obfuscation techniques to the APK format in order to hinder analysis

Obfuscated Files or Information
T1406

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cosmos.scrubber.pupil

cosmos.scrubber.pupil
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4693

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1406

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 8.2MB
SHA256 06d87d22601637e282a1c81a241fc77e105ae77023ea7476fc07f0f3aa6ee833
MD5 93926cbee6159a0a3b6b44931d78680f
SHA1 6cf7ff1959f416d23d5132084603f1343676590e
SHA512 c64ca5942a6bf9eae2e687df893cb4ffda6c1d4af99aa44bbaee34a74133d692686ce9c6b6ade02d766d0106951ab819068acbe8cd2c192ed03530f3d278a302
SSDEEP 196608:h0Ybz7OAcoPw5KR1V2tFFerG5d+jRNc8D3a8LNBoQD3rrXbh3nD:h0EBrP+q1eFQrWd03pNBoQPrbhz
TLSH
T16E86124BF788CB87D6AD83F96A3309A516232F05CB4216EB8254F77E2D3B1D10F95498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 1.3MB
SHA256 5078a12076f2f905b6686d3d5cd1afbcef946c39ee617ba99dda3b8775e62c4c
MD5 1f198f7d21ea820462690fd1afc594b7
SHA1 24ace9f3de101e02f384ef9c43000f2a8a44b085
SHA512 d5bc723641e4cb7f1b065a3dd5d0559821ffc619c63f42cc6ab4f3ecc79da557bc64067f732be3beb4fc472d67ae5bfc99d0a16663e4f156c57d7892dd096ae5
SSDEEP 24576:fZkg2TL7osTz8RZNugvYsXbTArQTOVr4yeZtdv:fZkg2H0cgToAYqTArQTOzmzv
TLSH
T13F559D47F3849A9EDAFE473A497252651133AD62CF53839BD928B33C18372D44FA4AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

final-signed.apk

Path /data/data/cosmos.scrubber.pupil/cache/final-signed.apk
Size 8.2MB
SHA256 5c2f38516455fc4a2901fe6358f2db64ec7bac64b21a7d4ff459101a7ca5241a
MD5 adc7f5306eea8b325e0ce165d75eb25e
SHA1 39582bdf6d8d7b6feeaa4306c34708874cc11c79
SHA512 f2d195bb027e131a75a0e9fef13323076300fcaf406d98733e5140ab30aad7ba50e501eac5059f7410edbc5d5030b516f1bed56102e0fb4209f0ef834783a175
SSDEEP 196608:TOAcoPw5KR1V2tFFerG5d+jRNc8D3a8LNBoQD3rrXbh3nD:ZrP+q1eFQrWd03pNBoQPrbhz
TLSH
T1DA86224B998DDBC3D61C82F8BA130DEA2A571B09C6512AFF4394EF9F3E185121DDA41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ۦۖ۫

Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
Size 8.0MB
SHA256 abefa69eaf00b4ac0807e82d430ff08d65241dba1badcce7f1dd04a002c057bf
MD5 bcce4b674b7af3409da3ecbb3dc10ec0
SHA1 7270e5129d1730d05767158bc6fb4af8085815f9
SHA512 369a92fc3d988286f7d600885a8365cff90767daee796edfb593876658eb47362ddf5feaa046fb7eae6c869e5193f81a0413c56afe3c2fe86e4b13d921f20824
SSDEEP 196608:cZyeXihM3JI+NmqVODWtD3sDM334jRVui5fC4HiOWsTVODxHyO/2O+cPNf:cZjHJrNFOoDcDo3Qf9C3sTgt/lNf
TLSH
T1AF8623C6E342889EC9FA4F34463A533122378C27D7578B979924F2B868336E42F95CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ۦۖ۫.

Path /data/data/cosmos.scrubber.pupil/files/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads