General

  • Target

    ready.apk

  • Size

    29KB

  • Sample

    240328-xr3dqadh4w

  • MD5

    a90158475e195dd26ad735082fa08bd7

  • SHA1

    b6b34fe6542b1b1cef4663d999ba4ad975f015e8

  • SHA256

    9035dc26a0773771274d431127e6789c35ea9c0af37efc6d80a090d12339c6f8

  • SHA512

    c4d2a15518ea01f0141a4bca775d7e45489944fdc566f0be7a8c99f357ef3248f3e2ce10f04973480254af102a3d51cb6dff5fdd1a0dbc747e33f47f0aac0d96

  • SSDEEP

    768:0SEw91JLqUKIEa10ZCWhG1fVdUhDUZ1pqSo4US/:YiJLqUKIEaPu+fVdqeiS/

Malware Config

Extracted

Family

spymax

C2

18.ip.gl.ply.gg:35336

Targets

    • Target

      ready.apk

    • Size

      29KB

    • MD5

      a90158475e195dd26ad735082fa08bd7

    • SHA1

      b6b34fe6542b1b1cef4663d999ba4ad975f015e8

    • SHA256

      9035dc26a0773771274d431127e6789c35ea9c0af37efc6d80a090d12339c6f8

    • SHA512

      c4d2a15518ea01f0141a4bca775d7e45489944fdc566f0be7a8c99f357ef3248f3e2ce10f04973480254af102a3d51cb6dff5fdd1a0dbc747e33f47f0aac0d96

    • SSDEEP

      768:0SEw91JLqUKIEa10ZCWhG1fVdUhDUZ1pqSo4US/:YiJLqUKIEaPu+fVdqeiS/

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Makes a phone call.

MITRE ATT&CK Mobile v15

Tasks