MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c365bd58edeb2ca371ead5e28350ee6c480a79f558d967ecbef525e9f1d7b3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

271

Origin country :

HK

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.193.1224.10474.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

spyware

Link:

https://www.filescan.io/uploads/6442ab48f2acc4ba529d04e5/reports/b8c28435-a886-42d0-8840-417ba3b6c51b/overview

Incinerator Legit

Result

Link:

https://incinerator.cloud/#/public/report/aab37e8b19fc0e9e353826fc10cb05e5/detail

Application Permissions

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/8c365bd58edeb2ca371ead5e28350ee6c480a79f558d967ecbef525e9f1d7b3e

Joe Sandbox SpyNote

Result

Threat name:

SpyNote

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1218744

Signature

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Contains a screen recorder (to take screenshot)

Detected SpyNote

May wipe phone data

Monitors outgoing Phone calls

Removes its application launcher (likely to stay hidden)

Requests to ignore battery optimizations

Starts/registers a service/receiver on screen off

Tries to detect Android x86

Tries to detect the analysis device (e.g. the Android emulator)

Uses accessibility services (likely to control other applications)

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8c365bd58edeb2ca371ead5e28350ee6c480a79f558d967ecbef525e9f1d7b3e/

ReversingLabs TitaniumCloud Android.Trojan.SpyNote

Threat name:

Android.Trojan.SpyNote

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-21 15:03:52 UTC

File Type:

Binary (Archive)

Extracted files:

140

AV detection:

9 of 22 (40.91%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rq3fxvmo32zmuny6vvpcqnio43cibj47kwgzm7wl55jf5hy5pm7a._file

Hatching Triage spynote

Result

Malware family:

spynote

Alert

Create hunting rule

Score:

  10/10

Tags:

family:spynote android banker evasion

Link:

https://tria.ge/reports/230421-svrn6sac4z/

Behaviour

Removes a system notification.

Legitimate hosting services abused for malware hosting/C2

Requests disabling of battery optimizations (often used to enable hiding in the background).

Acquires the wake lock.

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Malware Config

C2 Extraction:

1.tcp.sa.ngrok.io:26109

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI SpyNote

Threat name:

SpyNote

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8c365bd58edeb2ca371ead5e28350ee6c480a79f558d967ecbef525e9f1d7b3e