MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b59eb84ef03b1cbbbc172f65415a19790d74c72cdae6aa15e196c849a90fb084. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SpyNote

Vendor detections: 12

Intelligence 12 IOCs YARA 8 File information Comments

SHA256 hash:	b59eb84ef03b1cbbbc172f65415a19790d74c72cdae6aa15e196c849a90fb084
SHA3-384 hash:	b51c140a0ba56943e3bb4a3e4564659fbd47cc69a4c159d7fe6c70d6f466ed934b3203817007889b67cd7c60f04a2257
SHA1 hash:	18ad207695491745770462157e2d9eeb8252e949
MD5 hash:	66168cbe41625c567fe5c6b36d6ac571
humanhash:	pluto-nevada-bakerloo-indigo
File name:	ready.apk
Download:	download sample
Signature	SpyNote Create hunting rule
File size:	8'903'340 bytes
First seen:	2026-11-14 22:10:07 UTC
Last seen:	Never
File type:	apk
MIME type:	application/vnd.android.package-archive
ssdeep	98304:gXfL7qSyDCa5cYTd4/BRRzipCSpTy++mzVzBXTf0tUcN:gPLu7D3cY4dOC2zrQvN
TLSH	T12196F007F905CBD7C4AC93F52A134FA82E175F2896522AE710943A6F3E762D20ED65CC
TrID	39.4% (.APK) Android Package (27000/1/5) 19.7% (.JAR) Java Archive (13500/1/2) 19.7% (.ZAN) BlueEyes Animation (13500/1/4) 15.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 5.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Spynote

Code Signing Certificate

Organisation:	Android
Issuer:	Android
Algorithm:	md5WithRSAEncryption
Valid from:	2008-04-15T23:40:57Z
Valid to:	2035-09-01T23:40:57Z
Serial number:	f2b98e6123572c4e
Intelligence:	139 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Verdict:

Malware

Maliciousness:

Behaviour

Drawing windows over other applications

Getting information about active device administrators

Getting information about network

Accessing audio/video recording interfaces

Requests permission to display system notifications

Interacting with accessibility services

Sandbox detection

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 crypto evasive fingerprint persistence signed

Link:

https://www.filescan.io/uploads/6af8dc53bdaf48f7f6a76c5c/reports/2b4d5ca8-bed3-41cd-a59e-ba05e814e429/overview

Result

Link:

https://incinerator.cloud/#/public/report/66168cbe41625c567fe5c6b36d6ac571/detail

Application Permissions

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read phone state and identity (READ_PHONE_STATE)

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

set alarm in alarm clock (SET_ALARM)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/b59eb84ef03b1cbbbc172f65415a19790d74c72cdae6aa15e196c849a90fb084/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/b59eb84ef03b1cbbbc172f65415a19790d74c72cdae6aa15e196c849a90fb084

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b59eb84ef03b1cbbbc172f65415a19790d74c72cdae6aa15e196c849a90fb084/

Threat name:

Android.Trojan.SpyNote

Status:

Malicious

First seen:

2026-11-14 11:49:30 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

14 of 36 (38.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwplqtxqhmolxpaxf5sucwqzpegxjrzm3ltkufpbs3eetkipwcca._file

Result

Malware family:

spynote

Score:

10/10

Tags:

family:spynote android banker collection credential_access defense_evasion execution infostealer persistence rat trojan

Link:

https://tria.ge/reports/261114-13k6csd17x/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Acquires the wake lock

Makes use of the framework's foreground persistence service

Requests disabling of battery optimizations (often used to enable hiding in the background).

Makes use of the framework's Accessibility service

Family: Spynote

Malware Family:

Spynote

Verdict:

Malicious

Tags:

spynote config_extracted

YARA:

SUSP_APK_No_Launcher_Activity_Apr_08

Link:

https://app.threat.zone/submission/4cbf0126-fb95-4954-adee-ab9ef493ff72

Malware Config

C2 Extraction:

dan.cantdown.su:1841:1665

Malware Family:

spymax

Malicious:

True

Tags:

android apk obfuscated dynamic-loading debug-check sms-send telephony location-check reflection

Link:

https://intel.virussign.com/intelligence/file/b59eb84ef03b1cbbbc172f65415a19790d74c72cdae6aa15e196c849a90fb084

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Spynote_generic_strings Create hunting rule
Author:	Alberto Segura
Description:	Detects Spynote Android Malware

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	weird_png_data_after_end Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects data suspiciously located after a PNG's end header
Reference:	https://www.bleepingcomputer.com/news/microsoft/windows-11-snipping-tool-privacy-bug-exposes-cropped-image-content/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample