General

  • Target

    d08f288d2293fd2c39726f3a407a8a24fec85868f8576554395fe0b2a3a483a5.bin

  • Size

    879KB

  • Sample

    240322-1ww92sca6y

  • MD5

    d89f39b6fb9895bc109bf81cf805a6e2

  • SHA1

    252b79742742b107a211f7e83690a4fc50fd1546

  • SHA256

    d08f288d2293fd2c39726f3a407a8a24fec85868f8576554395fe0b2a3a483a5

  • SHA512

    3539c2b492522cb7b08c9d0f6e109617033d42a46a0023323ccc6a71327a9bf0281ac254220df4a804bb07926fc47456506dec85dbfae449681e69fb7bb1af84

  • SSDEEP

    12288:TVNqfVa1a8LVepwthneimK6Yh3DY5WmpYshXZPbGwidNpgg:TV8fVa1aKepwthei1T3DY5WmD9idNpv

Malware Config

Extracted

Family

spynote

C2

5.39.43.50:9595

Targets

    • Target

      d08f288d2293fd2c39726f3a407a8a24fec85868f8576554395fe0b2a3a483a5.bin

    • Size

      879KB

    • MD5

      d89f39b6fb9895bc109bf81cf805a6e2

    • SHA1

      252b79742742b107a211f7e83690a4fc50fd1546

    • SHA256

      d08f288d2293fd2c39726f3a407a8a24fec85868f8576554395fe0b2a3a483a5

    • SHA512

      3539c2b492522cb7b08c9d0f6e109617033d42a46a0023323ccc6a71327a9bf0281ac254220df4a804bb07926fc47456506dec85dbfae449681e69fb7bb1af84

    • SSDEEP

      12288:TVNqfVa1a8LVepwthneimK6Yh3DY5WmpYshXZPbGwidNpgg:TV8fVa1aKepwthei1T3DY5WmD9idNpv

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Matrix

Tasks