General

  • Target

    ec7a098f73da3827104ac23b68650797

  • Size

    1.1MB

  • Sample

    230514-d6t64sch31

  • MD5

    ec7a098f73da3827104ac23b68650797

  • SHA1

    13024f410a0ecd33c2133e73f3a46303196c5301

  • SHA256

    837c1e29ab597540e7fd396a6fc182c91a4f6601517838955501ac58fe23f665

  • SHA512

    9350ffffece99b70d114c86d9d8e6c83948616a7f3371b5bf3f8ad8e588854b70dc45cf1fa6ffef44620cec182508fc64d739a04ab664e6908fb1901bf9d9d49

  • SSDEEP

    24576:hWfEMzMmKu6xpu5cV0GverUMOHT3SFdDgGNJ81FgX:h8EThsmV1OqTCFdgq8gX

Malware Config

Extracted

Family

spynote

C2

104.233.203.226:27772

Targets

    • Target

      ec7a098f73da3827104ac23b68650797

    • Size

      1.1MB

    • MD5

      ec7a098f73da3827104ac23b68650797

    • SHA1

      13024f410a0ecd33c2133e73f3a46303196c5301

    • SHA256

      837c1e29ab597540e7fd396a6fc182c91a4f6601517838955501ac58fe23f665

    • SHA512

      9350ffffece99b70d114c86d9d8e6c83948616a7f3371b5bf3f8ad8e588854b70dc45cf1fa6ffef44620cec182508fc64d739a04ab664e6908fb1901bf9d9d49

    • SSDEEP

      24576:hWfEMzMmKu6xpu5cV0GverUMOHT3SFdDgGNJ81FgX:h8EThsmV1OqTCFdgq8gX

    Score
    8/10
    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks