General

  • Target

    ready.apk

  • Size

    15.3MB

  • Sample

    230928-2anlfsef71

  • MD5

    e5a89bcae0c0e5e6cd3bec30e11fd3f9

  • SHA1

    7cf72572ac3e6643a011dcda04043e6fdbc198c7

  • SHA256

    9a8a1f2f57dca02d518021ab4603e8c5a5e4a606ee9f6ff8cee27a8d0f0c203c

  • SHA512

    392f4497e18c7322c2e9c2b1acce252c240f5f30348a5e35bd92ce257c62676b2af0655128da88f5e32b3cd25531ba058c980b75a5e8211377cec15bfd46909e

  • SSDEEP

    24576:BDiwlfglBWItYYjwjCgI4hgN42HwaxGNA7R:dCTO87N4GwaxnF

Malware Config

Extracted

Family

spynote

C2

soon-lp.at.ply.gg:17209

Targets

    • Target

      ready.apk

    • Size

      15.3MB

    • MD5

      e5a89bcae0c0e5e6cd3bec30e11fd3f9

    • SHA1

      7cf72572ac3e6643a011dcda04043e6fdbc198c7

    • SHA256

      9a8a1f2f57dca02d518021ab4603e8c5a5e4a606ee9f6ff8cee27a8d0f0c203c

    • SHA512

      392f4497e18c7322c2e9c2b1acce252c240f5f30348a5e35bd92ce257c62676b2af0655128da88f5e32b3cd25531ba058c980b75a5e8211377cec15bfd46909e

    • SSDEEP

      24576:BDiwlfglBWItYYjwjCgI4hgN42HwaxGNA7R:dCTO87N4GwaxnF

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Removes its main activity from the application launcher

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks