MobiHok v6.7z
- SHA256 4655550f7e3a2ee8d330b444e1f4a6bdcf6ef9bdfcb4b18833a8f7a7305d1f8c
Behavioral task
behavioral1
Sample
MobiHok v6.7z
Resource
win10ltsc2021-20260911-en
spynote
[SPY_NOTE_HOST_OK]:[SPY_NOTE_PORT_OK]
Spynote is a Remote Access Trojan first seen in 2017.
| resource | yara_rule |
|---|---|
| static1/unpack001/MobiHok v6/Resources/Imports/Payload/stubzz.apk | family_spynote |
| description | ioc |
|---|---|
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN |
| description | ioc |
|---|---|
| Required by accessibility services to bind with the system. Allows apps to access accessibility features. | android.permission.BIND_ACCESSIBILITY_SERVICE |
| description | ioc |
|---|---|
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG |
| Allows an application to write and read the user's call log data. | android.permission.WRITE_CALL_LOG |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE |
| Allows an application to read SMS messages. | android.permission.READ_SMS |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG |
| Allows an application to send SMS messages. | android.permission.SEND_SMS |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows an application to record audio. | android.permission.RECORD_AUDIO |
| Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. | android.permission.PROCESS_OUTGOING_CALLS |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE |
| Allows an application to write and read the user's call log data. | android.permission.WRITE_CALL_LOG |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to record audio. | android.permission.RECORD_AUDIO |
| Allows an application to read SMS messages. | android.permission.READ_SMS |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS |
| Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. | android.permission.PROCESS_OUTGOING_CALLS |
Checks for missing APK codesign signature.
| resource |
|---|
| unpack001/MobiHok v6/Resources/Imports/Payload/stub.apk |
Checks for missing JAR codesign signature.
| resource |
|---|
| unpack001/MobiHok v6/Stub/apktool/signapk.jar |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack004/platform-tools/AdbWinApi.dll |
| unpack004/platform-tools/AdbWinUsbApi.dll |
| unpack004/platform-tools/adb.exe |
| unpack004/platform-tools/dmtracedump.exe |
| unpack004/platform-tools/etc1tool.exe |
| unpack004/platform-tools/fastboot.exe |
| unpack004/platform-tools/hprof-conv.exe |
| unpack004/platform-tools/libwinpthread-1.dll |
| unpack004/platform-tools/make_f2fs.exe |
| unpack004/platform-tools/mke2fs.exe |
| unpack004/platform-tools/sqlite3.exe |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/MobiHok v6/Resources/Imports/Payload/stubzz.apk |
| unpack001/MobiHok v6/Stub/stub.apk |
Unsigned JAR
Checks for missing JAR codesign signature.
Unsigned APK
Checks for missing APK codesign signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Spynote payload
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=116, id=1, productName=Unmarked objects,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=1, productName=Unmarked objects,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=73, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=40, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned JAR
Checks for missing JAR codesign signature.
Unsigned APK
Checks for missing APK codesign signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.