MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a16952bea9714cad6330960898edf6262c0e5e19d0b47716e31b6cc24463e07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7a16952bea9714cad6330960898edf6262c0e5e19d0b47716e31b6cc24463e07
SHA3-384 hash:	e2519987c8df64795270956381b584d06f823c1b61d2ec759a50e9cc9776c99465a829e832b338e2ff060478b0082456
SHA1 hash:	6a1aa5db36df20a667a0e58d89a4fcdcddf068f4
MD5 hash:	291c24d9b3f4a5793a2600610671eb42
humanhash:	kilo-early-apart-low
File name:	certapp-1.apk
Download:	download sample
Signature	SpyNote Alert Create hunting rule
File size:	4'122'540 bytes
First seen:	2023-07-31 10:07:31 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	12288:W12xH02TTyN1BYJoQDRLS4YiugstQYvvcZYF7xQTqiecs8uzvtelYxp8cmO87bYv:W41TNo+hrYiugEp3cZGi2JIYpgqv
TLSH	T14E16BE47FB926C81F5F6867AA920F365E7268C39C32352D35884712C2D7F2E14BAB4D1
TrID	52.8% (.APK) Android Package (32500/1/6) 21.9% (.JAR) Java Archive (13500/1/2) 17.0% (.SH3D) Sweet Home 3D design (generic) (10500/1/3) 6.5% (.ZIP) ZIP compressed archive (4000/1) 1.6% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	_icebre4ker_
Tags:	android apk signed Spynote spyware

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

454

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.193.15194.12605.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android smsspy spyagent

Link:

https://www.filescan.io/uploads/64c78804299c27f4c4f28b3c/reports/f81458c0-477a-4861-9d53-6887e541e2f6/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/291c24d9b3f4a5793a2600610671eb42/detail

Application Permissions

send SMS messages (SEND_SMS)

intercept outgoing calls (PROCESS_OUTGOING_CALLS)

read SMS or MMS (READ_SMS)

read contact data (READ_CONTACTS)

list accounts (GET_ACCOUNTS)

take pictures and videos (CAMERA)

record audio (RECORD_AUDIO)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

fine (GPS) location (ACCESS_FINE_LOCATION)

directly call phone numbers (CALL_PHONE)

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read phone state and identity (READ_PHONE_STATE)

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

set wallpaper (SET_WALLPAPER)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

set alarm in alarm clock (SET_ALARM)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7a16952bea9714cad6330960898edf6262c0e5e19d0b47716e31b6cc24463e07

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1283097

Signature

Antivirus / Scanner detection for submitted sample

Contains a screen recorder (to take screenshot)

Drops a new APK file

Monitors outgoing Phone calls

Multi AV Scanner detection for submitted file

Removes its application launcher (likely to stay hidden)

Requests to ignore battery optimizations

Uses accessibility services (likely to control other applications)

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a16952bea9714cad6330960898edf6262c0e5e19d0b47716e31b6cc24463e07/

ReversingLabs TitaniumCloud Android.Trojan.SpyNote

Threat name:

Android.Trojan.SpyNote

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-31 10:08:07 UTC

File Type:

Binary (Archive)

Extracted files:

79

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=piljkk7ks4kmvvrtbfqitdw7mjrmbzpbtufuo4logg3myjcghydq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

android evasion

Link:

https://tria.ge/reports/230731-l58bcafc71/

Behaviour

Removes a system notification.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Acquires the wake lock.

Makes use of the framework's Accessibility service.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.09

Link:

https://yomi.yoroi.company/submissions/7a16952bea9714cad6330960898edf6262c0e5e19d0b47716e31b6cc24463e07