MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c4fdf58abfb964bc40ea6888df21fd52fd35caeee49d2c7822e5a6a85a5314d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7c4fdf58abfb964bc40ea6888df21fd52fd35caeee49d2c7822e5a6a85a5314d
SHA3-384 hash:	cfcefeacca020fb68ca2c6d1125d4a5105983110bdb1d8a533109bf8be454dc25ff1caec297d806b357442b1c9e2ff38
SHA1 hash:	0e2e77c9676ed4014c7e3bd0e7f225963258e379
MD5 hash:	54b73c9dd2c6ef8284cf6e4386d2a435
humanhash:	echo-fruit-romeo-saturn
File name:	signed10317c.apk
Download:	download sample
Signature	SpyNote Alert Create hunting rule
File size:	1'621'577 bytes
First seen:	2023-04-18 12:48:39 UTC
Last seen:	2023-04-19 16:53:47 UTC
File type:	apk
MIME type:	application/zip
ssdeep	49152:WMSDW/YippUc5UoZ5/tIj4fP498X8K54zlqSJ:WMngipf5UoP/i4fP4YP54zl9J
TLSH	T166751242BB929666C87A46745EE3C3BA1577FD29CF2247273404731CD8B76E40F229E8
TrID	67.5% (.APK) Android Package (38500/1/9) 23.6% (.JAR) Java Archive (13500/1/2) 7.0% (.ZIP) ZIP compressed archive (4000/1) 1.7% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	ozuma5119
Tags:	android apk Spynote

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

229

Origin country :

JP

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.20.origin.24024.9411.UNOFFICIAL

Alert

Create hunting rule

Incinerator Legit

Result

Link:

https://incinerator.cloud/#/public/report/54b73c9dd2c6ef8284cf6e4386d2a435/detail

Application Permissions

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7c4fdf58abfb964bc40ea6888df21fd52fd35caeee49d2c7822e5a6a85a5314d

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1215640

Signature

Contains a screen recorder (to take screenshot)

Multi AV Scanner detection for submitted file

Removes its application launcher (likely to stay hidden)

Requests to ignore battery optimizations

Uses accessibility services (likely to control other applications)

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7c4fdf58abfb964bc40ea6888df21fd52fd35caeee49d2c7822e5a6a85a5314d/

ReversingLabs TitaniumCloud Android.Trojan.SpyMax

Threat name:

Android.Trojan.SpyMax

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-18 02:24:44 UTC

File Type:

Binary (Archive)

Extracted files:

135

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=prh56wfl7olexraou2ei34q72ux5gxfo5ze5fr4cfzngvbnfgfgq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

android

Link:

https://tria.ge/reports/230418-p2bpradc2t/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c4fdf58abfb964bc40ea6888df21fd52fd35caeee49d2c7822e5a6a85a5314d