APT37 Deploys New Android Spyware, Chinotto

This report analyzes 'Chinotto', an Android spyware sample attributed to North Korean APT37 (Reaper/Ricochet Chollima), describing how the app (SecureTalk, package com.private.talk) requests dangerous permissions to stealthily harvest contacts, SMS, call logs, device/account info, media and audio, and exfiltrates collected data to a C2 (http://haeundaejugong.com/…). The analysis includes manifest and source-code excerpts, observed commands, a SHA256 hash of the malicious APK, infrastructure notes (hosting in South Korea, fast-flux indicator), IOCs, and recommended mitigations for users and banks.