MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5294f5ff8d2190157b8a2c0863ee395764ad520ae397929f60756a6c810fb9ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SpyNote

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	5294f5ff8d2190157b8a2c0863ee395764ad520ae397929f60756a6c810fb9ff
SHA3-384 hash:	5b8a26f00ab597c0412fe4c1c21cb381495c6b5b080dc308f7af93fbbc432529c4fdfd03ecc1dcf8a8695fe6bc9de297
SHA1 hash:	715b0ee2b80ba278e988e4c4a9fea6ea2b3ca9c0
MD5 hash:	965e28f8a02ecdfcacacd5c8a431b5cc
humanhash:	uncle-early-uranus-tennessee
File name:	nerest.apk
Download:	download sample
Signature	SpyNote Create hunting rule
File size:	778'650 bytes
First seen:	2026-02-23 01:37:37 UTC
Last seen:	Never
File type:	apk
MIME type:	application/java-archive
ssdeep	12288:74g/Cha1a8LVeCIYlMuKVm5WmpYshXZPbGwidNpgssD:kgoa1aKeCPMTVm5WmD9idNpiD
TLSH	T144F47C86FB4AF867C9F7C6368275C66AD6460C544B47D7431985723C09BBBC08B8AFC8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Spynote

Code Signing Certificate

Organisation:	Benim ismim
Issuer:	Benim ismim
Algorithm:	sha1WithRSAEncryption
Valid from:	2017-10-17T16:35:54Z
Valid to:	2045-03-03T16:35:54Z
Serial number:	84d0fd4c97dce8b8
Intelligence:	33 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	bf7dcca87a4b2ef5c91d7eca38101bb8d0e2e91d849dae4e8213372065846930
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

176

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Android.Backdoor.791.origin.21864.12548.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

android base64 evasive fakeapp fingerprint horse obfuscated persistence signed spymax spynote tripoli

Link:

https://www.filescan.io/uploads/699baf8697feb4afd65292fa/reports/c9685f48-45e6-4fce-b807-b98a3d5068fd/overview

Result

Link:

https://incinerator.cloud/#/public/report/965e28f8a02ecdfcacacd5c8a431b5cc/detail

Application Permissions

write contact data (WRITE_CONTACTS)

take pictures and videos (CAMERA)

modify global system settings (WRITE_SETTINGS)

read external storage contents (READ_EXTERNAL_STORAGE)

read Browser's history and bookmarks (READ_HISTORY_BOOKMARKS)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

intercept outgoing calls (PROCESS_OUTGOING_CALLS)

retrieve running applications (GET_TASKS)

receive SMS (RECEIVE_SMS)

fine (GPS) location (ACCESS_FINE_LOCATION)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

list accounts (GET_ACCOUNTS)

directly call phone numbers (CALL_PHONE)

read phone state and identity (READ_PHONE_STATE)

read SMS or MMS (READ_SMS)

read contact data (READ_CONTACTS)

record audio (RECORD_AUDIO)

control flashlight (FLASHLIGHT)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

prevent phone from sleeping (WAKE_LOCK)

control vibrator (VIBRATE)

kill background processes (KILL_BACKGROUND_PROCESSES)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

set wallpaper size hints (SET_WALLPAPER_HINTS)

set wallpaper (SET_WALLPAPER)

create Bluetooth connections (BLUETOOTH)

show app notification (READ_APP_BADGE)

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/5294f5ff8d2190157b8a2c0863ee395764ad520ae397929f60756a6c810fb9ff/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/5294f5ff8d2190157b8a2c0863ee395764ad520ae397929f60756a6c810fb9ff

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5294f5ff8d2190157b8a2c0863ee395764ad520ae397929f60756a6c810fb9ff/

Threat name:

Android.Trojan.Tripoli

Status:

Malicious

First seen:

2026-02-19 17:06:26 UTC

File Type:

Binary (Archive)

Extracted files:

431

AV detection:

21 of 36 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kkkpl74negibk64kfqegh3rzk5sk2uqk4olzfh3aovvgzaipxh7q._file

Result

Malware family:

spynote

Score:

10/10

Tags:

family:spynote android banker defense_evasion discovery persistence

Link:

https://tria.ge/reports/260223-b2hleafy5h/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Malware Config

C2 Extraction:

95.156.205.13:55575

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.49

Link:

https://yomi.yoroi.company/submissions/5294f5ff8d2190157b8a2c0863ee395764ad520ae397929f60756a6c810fb9ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample