finfisher | ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e[.]apk

Resubmissions

31/10/2026, 19:10

261031-xvlkday1fw10

31/10/2026, 16:27

261031-tx2slaev3p10

Sharing

Copy URL Twitter E-mail

General

Target
ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk
Size 19.1MB
Sample261031-tx2slaev3p
SHA256 ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e
MD5 d037c03d526c9a130b8dcd346a95d858
SHA1 476d094e40b75d87a73d272c5a9fd6125e0cc8ae
SHA512 337cfca614dfea0835dd193c874f83f020c140e99a116e92636b926da1fd4397cb6603ee5e478104d9f885b865c1976296d0843dbf16962054c859adc1044ed3
SSDEEP 393216:JT6q2N1y8nGINjmzm5LAsolSsn0qynVXK8R0q9bKqLIopZJuk1:cNUgx+3yS0fVakKqLIUZJX
TLSH
T134172386F7D5EA07C477803286A34633104A8D2A9B22D6572715F37C2ABBDD05F4AECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spyware finfisher

Malware Config

Signatures

Family: FinFisher, FinSpy
FinFisher aka FinSpy is an Android spyware.
spyware finfisher

Android FinFisher payload 1 IoCs

resource	yara_rule
sample	family_finfisher

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk

File Explorer

ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk

.apk 19.1MB

ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk

SHA256 ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e
MD5 d037c03d526c9a130b8dcd346a95d858
SHA1 476d094e40b75d87a73d272c5a9fd6125e0cc8ae
SHA512 337cfca614dfea0835dd193c874f83f020c140e99a116e92636b926da1fd4397cb6603ee5e478104d9f885b865c1976296d0843dbf16962054c859adc1044ed3
SSDEEP 393216:JT6q2N1y8nGINjmzm5LAsolSsn0qynVXK8R0q9bKqLIopZJuk1:cNUgx+3yS0fVakKqLIUZJX
TLSH
T134172386F7D5EA07C477803286A34633104A8D2A9B22D6572715F37C2ABBDD05F4AECD
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

Android FinFisher payload
Codesign digest Mismatch

File was altered after it was signed.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ed73af65c11c0cf606adfb6c345205343a52ef78646b5a4620c3c9ab2d470bb1

Digest Algorithm

sha256

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Chains

Jan 1, 0001

com.smartapp.donottouch

org.xmlpush.v3.StartVersion

com.smartapp.donottouch.activity.SplashActivity

android.intent.action.MAIN

com.smartapp.donottouch.MainActivity

com.google.android.gms.ads.AdActivity

com.smartapp.donottouch.activity.StoreActivity

com.facebook.FacebookActivity

com.facebook.CustomTabActivity

android.intent.action.VIEW

com.smartapp.donottouch.activity.SettingsActivity

com.smartapp.donottouch.activity.ProTipsActivity

com.smartapp.donottouch.indruder.IntruderSelfie1Activity

com.smartapp.donottouch.indruder.IntruderSelfie2Activity

com.smartapp.donottouch.indruder.IntruderSelfie3Activity

com.smartapp.donottouch.indruder.IntruderSelfieEmailActivity

com.smartapp.donottouch.indruder.IntruderSelfieLockScreenActivity

com.smartapp.donottouch.indruder.IntruderSelfieGalleryActivity

com.smartapp.donottouch.activity.StatisticsActivity

com.smartapp.donottouch.indruder.IntruderSettingsActivity

com.applovin.adview.AppLovinInterstitialActivity

com.applovin.adview.AppLovinConfirmationActivity

com.smartapp.donottouch.indruder.IntruderSelfieEndActivity

com.smartapp.donottouch.activity.ScheduleActivity

com.smartapp.donottouch.activity.WrongAttemptActivity

com.smartapp.donottouch.activity.ringtones.RingtonesWallpapersActivity

com.smartapp.donottouch.indruder.IntruderSelfieVideoActivity

com.smartapp.donottouch.activity.SoundsActivity

com.smartapp.donottouch.activity.TutorialActivity

com.facebook.ads.AudienceNetworkActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.appinvite.PreviewActivity

com.google.android.gms.appinvite.ACTION_PREVIEW

com.google.android.gms.common.api.GoogleApiActivity

com.facebook.CustomTabMainActivity

pub.devrel.easypermissions.AppSettingsDialogHolderActivity

com.unity3d.ads.adunit.AdUnitActivity

com.unity3d.ads.adunit.AdUnitTransparentActivity

com.unity3d.ads.adunit.AdUnitTransparentSoftwareActivity

com.unity3d.ads.adunit.AdUnitSoftwareActivity

Android Permissions

ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk

Permissions

android.permission.WRITE_SMS

android.permission.WRITE_SETTINGS

android.permission.WRITE_CONTACTS

android.permission.SEND_SMS

android.permission.RECORD_AUDIO

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.READ_CALENDAR

android.permission.PROCESS_OUTGOING_CALLS

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.USE_FINGERPRINT

com.google.android.providers.gsf.permission.READ_GSERVICES

com.android.vending.BILLING

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_INTERNAL_STORAGE

android.permission.CAMERA

android.permission.VIBRATE

android.permission.GET_ACCOUNTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.SET_WALLPAPER

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.c2dm.permission.RECEIVE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk

File Signature issue

org.xmlpush.v3.StartVersion

com.smartapp.donottouch.activity.SplashActivity

com.smartapp.donottouch.MainActivity

com.google.android.gms.ads.AdActivity

com.smartapp.donottouch.activity.StoreActivity

com.facebook.FacebookActivity

com.facebook.CustomTabActivity

com.smartapp.donottouch.activity.SettingsActivity

com.smartapp.donottouch.activity.ProTipsActivity

com.smartapp.donottouch.indruder.IntruderSelfie1Activity

com.smartapp.donottouch.indruder.IntruderSelfie2Activity

com.smartapp.donottouch.indruder.IntruderSelfie3Activity

com.smartapp.donottouch.indruder.IntruderSelfieEmailActivity

com.smartapp.donottouch.indruder.IntruderSelfieLockScreenActivity

com.smartapp.donottouch.indruder.IntruderSelfieGalleryActivity

com.smartapp.donottouch.activity.StatisticsActivity

com.smartapp.donottouch.indruder.IntruderSettingsActivity

com.applovin.adview.AppLovinInterstitialActivity

com.applovin.adview.AppLovinConfirmationActivity

com.smartapp.donottouch.indruder.IntruderSelfieEndActivity

com.smartapp.donottouch.activity.ScheduleActivity

com.smartapp.donottouch.activity.WrongAttemptActivity

com.smartapp.donottouch.activity.ringtones.RingtonesWallpapersActivity

com.smartapp.donottouch.indruder.IntruderSelfieVideoActivity

com.smartapp.donottouch.activity.SoundsActivity

com.smartapp.donottouch.activity.TutorialActivity

com.facebook.ads.AudienceNetworkActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.appinvite.PreviewActivity

com.google.android.gms.common.api.GoogleApiActivity

com.facebook.CustomTabMainActivity

pub.devrel.easypermissions.AppSettingsDialogHolderActivity

com.unity3d.ads.adunit.AdUnitActivity

com.unity3d.ads.adunit.AdUnitTransparentActivity

com.unity3d.ads.adunit.AdUnitTransparentSoftwareActivity

com.unity3d.ads.adunit.AdUnitSoftwareActivity

org.xmlpush.v3.EventBasedService

org.xmlpush.v3.eventbased.ReceiverService

org.xmlpush.v3.schedule.SchedulerServices

org.xmlpush.v3.Services

com.smartapp.donottouch.AlarmService

com.smartapp.donottouch.utils.camera.VideoProcessingService

com.smartapp.donottouch.notification.PunchFirebaseMessagingService

com.smartapp.donottouch.notification.PunchFirebaseInstanceIDService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.iid.FirebaseInstanceIdService

org.xmlpush.v3.ReceiverMain

com.smartapp.donottouch.notification.NotificationPublisher

com.smartapp.donottouch.utils.charger.PlugInControlReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.crashlytics.android.CrashlyticsInitProvider

com.google.firebase.provider.FirebaseInitProvider

com.google.android.gms.ads.MobileAdsInitProvider

com.squareup.picasso.PicassoProvider

com.chibatching.kotpref.initializer.KotprefInitProvider

com.facebook.marketing.internal.MarketingInitProvider

com.facebook.internal.FacebookInitProvider

Android Permissions

ff8aaf49f4377e6ee162f1f0778f98e33dd2a8df2d96de6ba766851ee436467e.apk