MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f90b5a04fc46422771096a04498d4f8852a164f87e1775c8c1c6c209b9e88e6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

263

Origin country :

HK

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.193.32736.17172.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

spyware

Link:

https://www.filescan.io/uploads/6442aa932eb85408cdf69d40/reports/95109e8a-cb5c-4a14-9be0-8a5d522c9091/overview

Incinerator Legit

Result

Link:

https://incinerator.cloud/#/public/report/d01bdc22892242b07a1de38e95ecab1b/detail

Application Permissions

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f90b5a04fc46422771096a04498d4f8852a164f87e1775c8c1c6c209b9e88e6d

Joe Sandbox SpyNote

Result

Threat name:

SpyNote

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1218740

Signature

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Contains a screen recorder (to take screenshot)

Detected SpyNote

May wipe phone data

Monitors outgoing Phone calls

Multi AV Scanner detection for submitted file

Removes its application launcher (likely to stay hidden)

Requests to ignore battery optimizations

Starts/registers a service/receiver on screen off

Tries to detect Android x86

Tries to detect the analysis device (e.g. the Android emulator)

Uses accessibility services (likely to control other applications)

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f90b5a04fc46422771096a04498d4f8852a164f87e1775c8c1c6c209b9e88e6d/

ReversingLabs TitaniumCloud Android.Trojan.SpyNote

Threat name:

Android.Trojan.SpyNote

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-21 15:03:52 UTC

File Type:

Binary (Archive)

Extracted files:

140

AV detection:

10 of 22 (45.45%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7efvubh4izbco4ijnicetdkprbjkczhypylxlsgby3batopirzwq._file

Hatching Triage spynote

Result

Malware family:

spynote

Alert

Create hunting rule

Score:

  10/10

Tags:

family:spynote android banker evasion

Link:

https://tria.ge/reports/230421-ss2flaac4s/

Behaviour

Removes a system notification.

Legitimate hosting services abused for malware hosting/C2

Requests disabling of battery optimizations (often used to enable hiding in the background).

Acquires the wake lock.

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Malware Config

C2 Extraction:

1.tcp.sa.ngrok.io:26109

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.19

Link:

https://yomi.yoroi.company/submissions/f90b5a04fc46422771096a04498d4f8852a164f87e1775c8c1c6c209b9e88e6d