Resubmissions

06-04-2023 18:45

230406-xehhsage3x 10

06-04-2023 18:43

230406-xdd4zagd9z 10

06-04-2023 18:41

230406-xb7y9see24 10

General

  • Target

    satelite.apk

  • Size

    2.3MB

  • Sample

    230406-xehhsage3x

  • MD5

    737a6f3df6ec12e7b587e2672fae2b60

  • SHA1

    8adf72180e6a6b3f4007948a8ecf54b8bfaad3c0

  • SHA256

    5ea52e363d21207dba554b123ead36758f41600cc6d9123c4b300217b1733796

  • SHA512

    fc3b278c9eedd30c7f37883bb0c453996ca9a3b98f925597604a7a4f3bef9bd158fce5ac69c2b873b892d51ec8f92bf521bcfaaaae3563ec50c7fcd7b28a42c1

  • SSDEEP

    24576:7y0uq5ev9699WbPweohk+fWHXkHtcRbrLW:O0Bw9+9WbP4k+/Ht8r6

Malware Config

Extracted

Family

spynote

C2

1.tcp.sa.ngrok.io:26109

Targets

    • Target

      satelite.apk

    • Size

      2.3MB

    • MD5

      737a6f3df6ec12e7b587e2672fae2b60

    • SHA1

      8adf72180e6a6b3f4007948a8ecf54b8bfaad3c0

    • SHA256

      5ea52e363d21207dba554b123ead36758f41600cc6d9123c4b300217b1733796

    • SHA512

      fc3b278c9eedd30c7f37883bb0c453996ca9a3b98f925597604a7a4f3bef9bd158fce5ac69c2b873b892d51ec8f92bf521bcfaaaae3563ec50c7fcd7b28a42c1

    • SSDEEP

      24576:7y0uq5ev9699WbPweohk+fWHXkHtcRbrLW:O0Bw9+9WbP4k+/Ht8r6

    Score
    8/10
    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Legitimate hosting services abused for malware hosting/C2

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Enterprise v6

Tasks