MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SpyNote

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2
SHA3-384 hash:	c281b0872bd2e0a34b860526cb18970a94d46d2fc47faed8f1f3b30976b180d23d5eed098b131bf0810eecd766330e0a
SHA1 hash:	93a4f600802a7ebbdb3942d5dece330647ee4bd0
MD5 hash:	f6e5b0295cd87069e7c519cb28f9d495
humanhash:	queen-friend-high-nine
File name:	Zenin.apk
Download:	download sample
Signature	SpyNote Create hunting rule
File size:	782'638 bytes
First seen:	2026-03-21 20:50:43 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	12288:iYJ6sgRMLzXHGrfgVKR9ubWZlxi2odwvi/RwncvOXyX:9J6s9LzXHGrYVKR9ubsPgw6ucvOg
TLSH	T14EF48C86F70AB863C9F7C7368275866AC9160D654B53E3871985723C1DBBBC08B85FC8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Spynote

Code Signing Certificate

Organisation:	Android
Issuer:	Android
Algorithm:	sha1WithRSAEncryption
Valid from:	2008-02-29T01:33:46Z
Valid to:	2035-07-17T01:33:46Z
Serial number:	936eacbe07f201df
Intelligence:	1874 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

346

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Android.Backdoor.791.origin.21864.12548.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

android base64 evasive fingerprint obfuscated persistence signed

Link:

https://www.filescan.io/uploads/69bf04c5493cb7d62d0b56fd/reports/10777850-675a-40aa-b858-ae77f6699ff6/overview

Result

Link:

https://incinerator.cloud/#/public/report/f6e5b0295cd87069e7c519cb28f9d495/detail

Application Permissions

write contact data (WRITE_CONTACTS)

take pictures and videos (CAMERA)

modify global system settings (WRITE_SETTINGS)

read external storage contents (READ_EXTERNAL_STORAGE)

read Browser's history and bookmarks (READ_HISTORY_BOOKMARKS)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

intercept outgoing calls (PROCESS_OUTGOING_CALLS)

retrieve running applications (GET_TASKS)

receive SMS (RECEIVE_SMS)

fine (GPS) location (ACCESS_FINE_LOCATION)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

list accounts (GET_ACCOUNTS)

directly call phone numbers (CALL_PHONE)

read phone state and identity (READ_PHONE_STATE)

read SMS or MMS (READ_SMS)

read contact data (READ_CONTACTS)

record audio (RECORD_AUDIO)

control flashlight (FLASHLIGHT)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

prevent phone from sleeping (WAKE_LOCK)

control vibrator (VIBRATE)

kill background processes (KILL_BACKGROUND_PROCESSES)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

set wallpaper size hints (SET_WALLPAPER_HINTS)

set wallpaper (SET_WALLPAPER)

create Bluetooth connections (BLUETOOTH)

show app notification (READ_APP_BADGE)

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2/

Threat name:

Android.Trojan.Tripoli

Status:

Malicious

First seen:

2026-03-21 20:51:26 UTC

File Type:

Binary (Archive)

Extracted files:

431

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qfgncfndbrnux65sozjeo5fdvurznz7ti3e7ba4ygey3hyecadja._file

Result

Malware family:

spynote

Score:

10/10

Tags:

family:spynote android banker defense_evasion discovery impact persistence privilege_escalation

Link:

https://tria.ge/reports/260321-zm99wabt6z/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Tries to add a device administrator.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Malware Config

C2 Extraction:

tcp.cloudpub.ru:57786

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.49

Link:

https://yomi.yoroi.company/submissions/814cd115a30c5b4bfbb276524774a3ad2396e7f346c9f083983131b3e08200d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample