MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f922df9bde2e816064bbc23c5e4d4ec833f8f0d822c0f097f3b584ec81df032. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2f922df9bde2e816064bbc23c5e4d4ec833f8f0d822c0f097f3b584ec81df032
SHA3-384 hash:	c461096aba6fd0c0ce815263a6c8703ffd45883b9a62341ecdb9a9d7a457e7601594938f4bc348ef70a6a9cec30c1f40
SHA1 hash:	2a7a8d1219b66db2f5ed3c5af0043460597f4286
MD5 hash:	0e69fd9ea5ddfda38a1d73621def19a3
humanhash:	six-snake-music-finch
File name:	bradesco.apk
Download:	download sample
Signature	SpyNote Alert Create hunting rule
File size:	1'366'416 bytes
First seen:	2023-04-21 13:18:17 UTC
Last seen:	2023-04-21 15:22:32 UTC
File type:	apk
MIME type:	application/zip
ssdeep	24576:Xj3n7M/NASUj+VX1sTNq/NOLvfHhf6Hfsp4HUj/k:XjLM1nbsxqQ3HhmfspJjs
TLSH	T1AF55F14BEB45D8E6D9F3873A66319236A0274DB5270396D73DA4FA3C25BB6C003239D4
TrID	57.0% (.APK) Android Package (38500/1/9) 20.0% (.JAR) Java Archive (13500/1/2) 15.5% (.SH3D) Sweet Home 3D design (generic) (10500/1/3) 5.9% (.ZIP) ZIP compressed archive (4000/1) 1.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	r3dbU7z
Tags:	apk signed Spynote

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

241

Origin country :

RU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.193.8071.24972.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm spyware

Link:

https://www.filescan.io/uploads/64428d4890012911b698c8ee/reports/6c032ac2-df15-49db-ad59-ee464e46c332/overview

Incinerator Legit

Result

Link:

https://incinerator.cloud/#/public/report/0e69fd9ea5ddfda38a1d73621def19a3/detail

Application Permissions

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/2f922df9bde2e816064bbc23c5e4d4ec833f8f0d822c0f097f3b584ec81df032

Joe Sandbox SpyNote

Result

Threat name:

SpyNote

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1218639

Signature

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Contains a screen recorder (to take screenshot)

Detected SpyNote

Drops a new APK file

May wipe phone data

Monitors outgoing Phone calls

Multi AV Scanner detection for submitted file

Removes its application launcher (likely to stay hidden)

Requests to ignore battery optimizations

Starts/registers a service/receiver on screen off

Tries to detect Android x86

Tries to detect the analysis device (e.g. the Android emulator)

Uses accessibility services (likely to control other applications)

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2f922df9bde2e816064bbc23c5e4d4ec833f8f0d822c0f097f3b584ec81df032/

ReversingLabs TitaniumCloud Android.Trojan.SpyNote

Threat name:

Android.Trojan.SpyNote

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-21 13:19:10 UTC

File Type:

Binary (Archive)

Extracted files:

140

AV detection:

9 of 19 (47.37%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f6jc36n54lubmbslxqr4lzgu5sbt7dynqiwa6cl7hnme5sa56aza._file

Hatching Triage spynote

Result

Malware family:

spynote

Alert

Create hunting rule

Score:

  10/10

Tags:

family:spynote android evasion

Link:

https://tria.ge/reports/230421-qkhx6shf2t/

Behaviour

Removes a system notification.

Legitimate hosting services abused for malware hosting/C2

Requests disabling of battery optimizations (often used to enable hiding in the background).

Acquires the wake lock.

Makes use of the framework's Accessibility service.

Malware Config

C2 Extraction:

1.tcp.sa.ngrok.io:26109

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.19

Link:

https://yomi.yoroi.company/submissions/2f922df9bde2e816064bbc23c5e4d4ec833f8f0d822c0f097f3b584ec81df032