General
-
Target
satelite.apk
-
Size
2.3MB
-
Sample
230406-xehhsage3x
-
MD5
737a6f3df6ec12e7b587e2672fae2b60
-
SHA1
8adf72180e6a6b3f4007948a8ecf54b8bfaad3c0
-
SHA256
5ea52e363d21207dba554b123ead36758f41600cc6d9123c4b300217b1733796
-
SHA512
fc3b278c9eedd30c7f37883bb0c453996ca9a3b98f925597604a7a4f3bef9bd158fce5ac69c2b873b892d51ec8f92bf521bcfaaaae3563ec50c7fcd7b28a42c1
-
SSDEEP
24576:7y0uq5ev9699WbPweohk+fWHXkHtcRbrLW:O0Bw9+9WbP4k+/Ht8r6
Malware Config
Extracted
spynote
1.tcp.sa.ngrok.io:26109
Targets
-
-
Target
satelite.apk
-
Size
2.3MB
-
MD5
737a6f3df6ec12e7b587e2672fae2b60
-
SHA1
8adf72180e6a6b3f4007948a8ecf54b8bfaad3c0
-
SHA256
5ea52e363d21207dba554b123ead36758f41600cc6d9123c4b300217b1733796
-
SHA512
fc3b278c9eedd30c7f37883bb0c453996ca9a3b98f925597604a7a4f3bef9bd158fce5ac69c2b873b892d51ec8f92bf521bcfaaaae3563ec50c7fcd7b28a42c1
-
SSDEEP
24576:7y0uq5ev9699WbPweohk+fWHXkHtcRbrLW:O0Bw9+9WbP4k+/Ht8r6
-
Makes use of the framework's Accessibility service.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
-
Acquires the wake lock.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Removes a system notification.
-