bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e.7z
- SHA256 d0323e31486e7a8073eb815b80884d40a76d168f7f680be062a222623198eae5
Password
infected
Behavioral task
behavioral1
Sample
bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
5 signatures
600 seconds
Behavioral task
behavioral2
Sample
bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e.apk
Resource
android-33-x64-arm64-20260721-en
android-13-x64
4 signatures
600 seconds
General
- Target bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e.7z
- Size 631KB
- Sample261005-b81ess1dpg
- SHA256 d0323e31486e7a8073eb815b80884d40a76d168f7f680be062a222623198eae5
- MD5 e684b1e47480065ed03f84171b1d5b62
- SHA1 11fc7a4ee9d068fe863e3e6aaa1743dd20dddef3
- SHA512 4b0ab6d2bd37c1933cf6e90dd8536d90b1fe2da365a3d906b4f86b4e0fa8eee1c1464d7d59d9423128121dc5137e37aa78df710ce242e4c935b72d89433889c0
- SSDEEP 12288:Gx82E/cd+PCh9f0JSub2T+T1R98hc81/4f+Hrsvq316jEYAMBr:Gx1Etqh1yjyT+Huc8Sf+Hr8C16oY5Br
- TLSH T1F2D4237C63A1C94BB5417E5EF9B80CA50FAF0B28C37EC4896CA5D9073586C01867BF98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
spynote
C2
-
159.203.126.35:22526
Signatures
- Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
- Declares services with permission to bind to the system 1 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE - Requests dangerous framework permissions 16 IoCs
description ioc Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to read the user's call log. android.permission.READ_CALL_LOG Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS Required to be able to access the camera device. android.permission.CAMERA Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to record audio. android.permission.RECORD_AUDIO Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write and read the user's call log data. android.permission.WRITE_CALL_LOG Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e
File Explorer
-
bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e.7z.7z 631KB
-
bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e.apk 676KB
bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e
- SHA256 bd172dbb47a95e7abc3ce76118bf6cd3f742d7c932ec8801cd553509f31eca8e
- MD5 288d300db70bc4d68bea5ffabbaedc42
- SHA1 cb97095b5f002a351869f2970ad6284a12c86431
- SHA512 9dedf3772d2207644c5371b020516cc7081c2f6a556f12d79c756ba409b7ca895143c9f42041f89e612478e31c40aa731a13a78edf3188e3f61cbe73676d311b
- SSDEEP 12288:VZd+RjBgbBUjq0jhczeTPBvf1MRusT3cgtN0Fhm46Rq218gAp:j0JGWZjuiTPBv9MRHT3SFhm4GNBAp
- TLSH T160E42283B356C5AEE9E6113F8A0656431A377DA58F42BB7B35DBBA2C15332D05F21E00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
File Signature issue
Digest
26f3e0f4c722811b81fb983042da3dd646ddac3987a3af498ea23da80d6b99b9
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=google play,OU=google,O=google,L=USA,ST=California,C=California
Subject
CN=google play,OU=google,O=google,L=USA,ST=California,C=California
Serial Number
17:0d:ed:5b
Issuer
CN=google play,OU=google,O=google,L=USA,ST=California,C=California
Timespan
Jul 16, 2021 - Feb 25, 4110
splash.app.main
splash.app.ʼⁱʾˈㅤ$ʻ䉀ᵢ$ᘣ$ᵔˎᵢㅤʻˎՙᵇ$ʾʾᴵᵢᵎφ4944
android.permission.FOREGROUND_SERVICE
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.GET_ACCOUNTS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.CAMERA
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.WRITE_CALL_LOG
android.permission.WRITE_CONTACTS
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.CALL_PHONE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.SET_WALLPAPER
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
oppo.permission.OPPO_COMPONENT_SAFE
com.huawei.permission.external_app_settings.USE_COMPONENT
splash.app.ʼⁱʾˈㅤ$ʻ䉀ᵢ$ᘣ$ᵔˎᵢㅤʻˎՙᵇ$ʾʾᴵᵢᵎφ4944
splash.app.ᴵˉⶱⶨ$₫ﹳˎㅤㅤˊ$ᵢೲᴵ䉀ⶱೲי䉀ᘣφˈʾ䉀ᘣ䉀ʼ4957
splash.app.ᵢʼᴵʾיʾ䉀ʾⁱㅤʾʽﹳˉﹶ$ㅤㅤיⶱ䉀$ˋᵢʿˑʿ4954
splash.app.ˈⶱˋθ$יⶱʾʿᴵ$ʿـㅤᴵʾⶱ$ˏʾˆʾʾᵎⶱⁱ4960
splash.app.ﾞˊʿ$ⶱˉᘣঙ䉀י䉀䉀ʾʾⶱᵎㅤ䉀ˑˉ䉀ˎייʾঙʽᴵʿφʾʿ4950
splash.app.$ᵔˆⶱঙˉ₫$θﹳೲⶱⶱᵇᴵﹳㅤᵔﹳθ$ʾˎᵢⶱθ4953
splash.app.ˈㅤᴵθﹶʾˈ䉀$ʻφ$ˋ$$ᵔٴⶱˎ䉀$ⶱﹶᵔⶨ$ㅤʿㅤᵇθᴵ䉀4952
splash.app.ˎⶱ䉀ㅤˆˈٴθﹶٴᵔᘣˎʾᵔיﹶᵢˏˋˊʾⶱʾ4958
splash.app.ـ$ˉ$ʿθˋʿ䉀$ᵇθ䉀$θʿᵢφˋיʿˊㅤ$ㅤיᵇٴθˎ$ˈ4951
splash.app.ᴵˎʿⶱⶱ䉀$ˋㅤי$ㅤᴵʼθˉⶱʼㅤㅤـⶱⶱㅤᵢ䉀φˉʼ䉀49371
splash.app.$י䉀ٴφˋⶨᵢⶨᵢﾞˋᴵᵔˈי$$ᴵθᴵ䉀ʾˉ䉀ˈˈˆㅤﹶㅤՙ$ⶱ4942
splash.app.θθ$$ⶱ$ㅤθㅤⶱʿㅤⶱᵢᘣﹳㅤᵇ䉀ʾ$4941
splash.app.ᴵˎʿⶱⶱ䉀$ˋㅤי$ㅤᴵʼθˉⶱʼㅤㅤـⶱⶱㅤᵢ䉀φˉʼ䉀49372
android.accessibilityservice.AccessibilityService
splash.app.ˈ$ˋ$$ೲ$ᵢʾʿ䉀ⶱˈʾㅤʿᵢㅤθʿⶱ䉀ﹳﾞʿˎ4959
splash.app.ʾ䉀ᵢⶱⁱʼ䉀ⶱⶱʽˎᴵʿ$$ᵔיˆˈʿㅤ䉀ˉㅤʿˋ4967
splash.app.ᴵˎʿⶱⶱ䉀$ˋㅤי$ㅤᴵʼθˉⶱʼㅤㅤـⶱⶱㅤᵢ䉀φˉʼ䉀49373
splash.app.ⶱˎⶱٴʼיˋᴵˆ$ʾˎˎ䉀ʾʾφঙᘣʻˊ䉀ㅤ$$ⶱⶱⶱʾㅤˎ䉀ㅤ4956
splash.app.SensorRestarterBroadcastReceiver
ac.in.ActivityRecognition.RestartSensor
splash.app.ᴵˎʿⶱⶱ䉀$ˋㅤי$ㅤᴵʼθˉⶱʼㅤㅤـⶱⶱㅤᵢ䉀φˉʼ䉀4937
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
splash.app.RC
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
splash.app.ᴵˎʿⶱⶱ䉀$ˋㅤי$ㅤᴵʼθˉⶱʼㅤㅤـⶱⶱㅤᵢ䉀φˉʼ䉀49374
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.Intent.ACTION_USER_PRESENT
splash.app._callr_lsnr_
android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL