General

  • Target

    Grab And Go v9.3.apk

  • Size

    7.0MB

  • Sample

    230824-js594sce5w

  • MD5

    a4076d3b61690e8f2c3f0ac909b09aa9

  • SHA1

    34656932135ebec7fd25e17f520e9111c953b3a9

  • SHA256

    a8ee13e9c66934fb7b78983ccbfa5e23ca7c3ae0f5339762ff50f6d7b4feb439

  • SHA512

    6e04204e29e363febc819e2fbda3502825e5cb6ea833c3e4ea07e448f1d56204afaa2d92bcb24e8d95e1e437c2d535f5606c245f7004adde7e99b1aa93012b47

  • SSDEEP

    12288:Hqnl5dlp/KXtatM9BmAtmOaID7nbaMpg0ebwvfBvrqvvUCnsU1+BrQgMgNNKG1GM:Hq5dn/KmAX/aMpg03BzevuU1+ggjOAH

Malware Config

Extracted

Family

spynote

C2

148.66.21.163:1151

Targets

    • Target

      Grab And Go v9.3.apk

    • Size

      7.0MB

    • MD5

      a4076d3b61690e8f2c3f0ac909b09aa9

    • SHA1

      34656932135ebec7fd25e17f520e9111c953b3a9

    • SHA256

      a8ee13e9c66934fb7b78983ccbfa5e23ca7c3ae0f5339762ff50f6d7b4feb439

    • SHA512

      6e04204e29e363febc819e2fbda3502825e5cb6ea833c3e4ea07e448f1d56204afaa2d92bcb24e8d95e1e437c2d535f5606c245f7004adde7e99b1aa93012b47

    • SSDEEP

      12288:Hqnl5dlp/KXtatM9BmAtmOaID7nbaMpg0ebwvfBvrqvvUCnsU1+BrQgMgNNKG1GM:Hq5dn/KmAX/aMpg03BzevuU1+ggjOAH

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Removes its main activity from the application launcher

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks