spynote | youtubelite[.]apk

General

Target
youtubelite.apk
Size 3.0MB
Sample261023-pmwrdady7j
SHA256 6a159dc8f4c356b56752e9528d30038f2eb796451b4d88c90789bcab0b7feeb7
MD5 30b89e6cfb813522457bb897ba1aa819
SHA1 59340fd839e25431c72dcc0edfc0eda98208aff8
SHA512 decdc1178d68cfb5c5a6031024154ef33a9dacc8463a4554e500c3e2b8ffcb89b8a3cd37895354911a51470a3cc52d1d9c1617b025f8d37a803ee6b9b6f8abb1
SSDEEP 98304:dQjJKIn5OJWG/9AE1femzPzBfTS0tIkhEL:G4jaqf5zdR1g
TLSH
T191E5DF03FB45CBE7D8AA83F56F230DA95A074F58C642AAE744507A6E3E771C10DC5A8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer rat spynote

Malware Config

Signatures

Family: Spynote
Spynote is a Remote Access Trojan first seen in 2017.
banker trojan infostealer rat spynote

Spynote payload 1 IoCs

resource	yara_rule
sample	family_spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
youtubelite.apk

File Explorer

youtubelite.apk

.apk 3.0MB

youtubelite.apk

SHA256 6a159dc8f4c356b56752e9528d30038f2eb796451b4d88c90789bcab0b7feeb7
MD5 30b89e6cfb813522457bb897ba1aa819
SHA1 59340fd839e25431c72dcc0edfc0eda98208aff8
SHA512 decdc1178d68cfb5c5a6031024154ef33a9dacc8463a4554e500c3e2b8ffcb89b8a3cd37895354911a51470a3cc52d1d9c1617b025f8d37a803ee6b9b6f8abb1
SSDEEP 98304:dQjJKIn5OJWG/9AE1femzPzBfTS0tIkhEL:G4jaqf5zdR1g
TLSH
T191E5DF03FB45CBE7D8AA83F56F230DA95A074F58C642AAE744507A6E3E771C10DC5A8C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Spynote payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

3cec394382d5d19bffcb937d2ede6d2a751a4d799b17703679df53b5c2dcfa88

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

upgrade.legacy.prov

Android Permissions

youtubelite.apk

Permissions

android.permission.RECORD_AUDIO

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

oppo.permission.OPPO_COMPONENT_SAFE

oplus.permission.OPLUS_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

android.permission.INTERNET

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

com.android.alarm.permission.SET_ALARM

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.USE_FULL_SCREEN_INTENT

Sharing

General

Malware Config

Signatures

File Explorer

youtubelite.apk

File Signature issue

upgrade.legacy.jojvf2.MainActivity

upgrade.legacy.jojvf2.RequestAccess

upgrade.legacy.jojvf2.FloatingView

upgrade.legacy.jojvf2.rcmgh4.CraxsBrowser

upgrade.legacy.jojvf2.CameraActvity

upgrade.legacy.jojvf2.RequestScreenCap

upgrade.legacy.jojvf2.SecondActivity

upgrade.legacy.jojvf2.WakeupActivity

upgrade.legacy.jojvf2.RequestUninstall

upgrade.legacy.jojvf2.RequestInstallPrim

upgrade.legacy.jojvf2.installupdate

upgrade.legacy.jojvf2.flyActivity

upgrade.legacy.jojvf2.OpenActivity

upgrade.legacy.jojvf2.OpenChrome

upgrade.legacy.jojvf2.RequestDrawOver

upgrade.legacy.jojvf2.RequestDataUsage

upgrade.legacy.jojvf2.RequestVPN

upgrade.legacy.jojvf2.RequestPermissions

upgrade.legacy.jojvf2.RequestOPPOB

upgrade.legacy.jojvf2.RequestPermission2

upgrade.legacy.jojvf2.RequestKeyboard

upgrade.legacy.jojvf2.RequestBattery

upgrade.legacy.jojvf2.RequestAdmin

upgrade.legacy.jojvf2.tjyeg3.initializeService

upgrade.legacy.jojvf2.rcmgh4.CameraHandler

upgrade.legacy.jojvf2.tjyeg3.LocationService

upgrade.legacy.jojvf2.tjyeg3.AccessService

upgrade.legacy.jojvf2.tjyeg3.BackgroundWorker

upgrade.legacy.jojvf2.tjyeg3.CommandsService

upgrade.legacy.jojvf2.tjyeg3.FirewallServices

upgrade.legacy.jojvf2.StartScreenCapture

upgrade.legacy.jojvf2.tjyeg3.MyJobService

upgrade.legacy.jojvf2.tjyeg3.KeyboardService

upgrade.legacy.jojvf2.sfvok5.CustomReceiver

upgrade.legacy.jojvf2.sfvok5.BootReceiver

upgrade.legacy.jojvf2.sfvok5.PackagesReceiver

upgrade.legacy.jojvf2.sfvok5.ScreenReceiver

upgrade.legacy.jojvf2.sfvok5.Datareciver

upgrade.legacy.AdminReceiver

androidx.core.content.FileProvider

androidx.core.content.FileProvider

Android Permissions

youtubelite.apk