General

  • Target

    appapp.apk

  • Size

    10.2MB

  • Sample

    231114-k9s7jsad2z

  • MD5

    9fe275b0ba22bfc9517eeea2cf3ae71e

  • SHA1

    62dec5d540affa35331b2f7250a3da41f5e71794

  • SHA256

    63b39e94bb36c06abaf77dd38cb1e6b6b6639f9f92e7033be4383834e5022ded

  • SHA512

    0ae9cd2c3387f5fb5f6389d8e1d3c31e45daa1aa61c7b69fe2261bcc1fad06d77ef64008b8315a68f4a8d0863f520b514a93973004005bf2ab2452caf1d1abaf

  • SSDEEP

    98304:mlNpIVdCJ5BCqF1jHgljRv/PoN6iKcDjf/f+4rKmzDzBeT2b0tADsINA:mlN4dwDCqXjUj1XoLDDj+4rlzg/wbA

Malware Config

Extracted

Family

spynote

C2

85.192.63.217:7771

Targets

    • Target

      appapp.apk

    • Size

      10.2MB

    • MD5

      9fe275b0ba22bfc9517eeea2cf3ae71e

    • SHA1

      62dec5d540affa35331b2f7250a3da41f5e71794

    • SHA256

      63b39e94bb36c06abaf77dd38cb1e6b6b6639f9f92e7033be4383834e5022ded

    • SHA512

      0ae9cd2c3387f5fb5f6389d8e1d3c31e45daa1aa61c7b69fe2261bcc1fad06d77ef64008b8315a68f4a8d0863f520b514a93973004005bf2ab2452caf1d1abaf

    • SSDEEP

      98304:mlNpIVdCJ5BCqF1jHgljRv/PoN6iKcDjf/f+4rKmzDzBeT2b0tADsINA:mlN4dwDCqXjUj1XoLDDj+4rlzg/wbA

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Removes its main activity from the application launcher

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Removes a system notification.

MITRE ATT&CK Matrix

Tasks