MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf58d431913c80ef220eb0e18c5c6a88651012a7cc5b3f73f7cbd4a3f5870053. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cf58d431913c80ef220eb0e18c5c6a88651012a7cc5b3f73f7cbd4a3f5870053
SHA3-384 hash:	5bf03ebb199c610ed75f6233446998676e34ed5da0d067a63dec807077779cf98955bfd3eaa5699f5201dd82dbe36bd8
SHA1 hash:	bd450f774b2f4d5e4ec7f1972d03f335af63c75d
MD5 hash:	1cc5c3038d43cffe4a35be3893d3d480
humanhash:	pizza-freddie-bulldog-jig
File name:	x.apk
Download:	download sample
Signature	SpyNote Alert Create hunting rule
File size:	3'825'271 bytes
First seen:	2024-07-02 04:50:21 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:HfGQjUdFB52/47PVmzJX9czka5xynCA19uLxsmz0zdGGsQTOGqU0Yqc0cgp47HK:HOQgHY6PVSJNukkx0Pxmz0zBLT90tp4K
TLSH	T16E06F107EE45CBC3D46C97F86E130CE42E275F28C5816BEB00553A6E7EBA2960EC559C
TrID	43.3% (.APK) Android Package (32500/1/6) 18.0% (.ZAN) BlueEyes Animation (13500/1/4) 18.0% (.JAR) Java Archive (13500/1/2) 14.0% (.SH3D) Sweet Home 3D design (generic) (10500/1/3) 5.3% (.ZIP) ZIP compressed archive (4000/1)
Reporter	lontze7
Tags:	apk signed Spynote

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

270

Origin country :

GR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.291.21815.21697.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2.5/10

Confidence:

90%

Link:

https://www.filescan.io/uploads/6683873926c925aa13a6f740/reports/60b65063-712d-4875-a05b-180a2daeb06f/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/1cc5c3038d43cffe4a35be3893d3d480/detail

Application Permissions

read contact data (READ_CONTACTS)

list accounts (GET_ACCOUNTS)

take pictures and videos (CAMERA)

record audio (RECORD_AUDIO)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

fine (GPS) location (ACCESS_FINE_LOCATION)

directly call phone numbers (CALL_PHONE)

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read phone state and identity (READ_PHONE_STATE)

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

send SMS messages (SEND_SMS)

read SMS or MMS (READ_SMS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

set alarm in alarm clock (SET_ALARM)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

set wallpaper (SET_WALLPAPER)

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/cf58d431913c80ef220eb0e18c5c6a88651012a7cc5b3f73f7cbd4a3f5870053

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf58d431913c80ef220eb0e18c5c6a88651012a7cc5b3f73f7cbd4a3f5870053/

ReversingLabs TitaniumCloud Android.Trojan.SpyNote

Threat name:

Android.Trojan.SpyNote

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-07-02 04:51:06 UTC

File Type:

Binary (Archive)

Extracted files:

88

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z5mnimmrhsao6iqowdqyyxdkrbsraevhzrnt647xzpkkh5mhabjq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

android

Link:

https://tria.ge/reports/240702-fgtkdszhkq/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cf58d431913c80ef220eb0e18c5c6a88651012a7cc5b3f73f7cbd4a3f5870053