General

  • Target

    ba2b6a4894af9d7bd10c18abb0c014023ea00e65cd297b3c2e1c3ecb7808867f.bin

  • Size

    760KB

  • Sample

    240407-1x34zsfg4w

  • MD5

    b0f7e6f1a87b525d0ff8e8d675d34b4f

  • SHA1

    8a912fe7e83efd01e38983ff9e03272aa8ccd7e4

  • SHA256

    ba2b6a4894af9d7bd10c18abb0c014023ea00e65cd297b3c2e1c3ecb7808867f

  • SHA512

    35515f12fe86d8f08c4d5f7eadd3f11e6d9b5262a802e7ccbf7a1db050b966333c9d6db4616a3dce0ac9cd2899d751d8c058ad92be7bdf74d9b4f73d9d4fc08e

  • SSDEEP

    12288:wnjlzlmJ6sgR8LzLx7OB2XSM5WmpYshXZPbGwidNpgb:wnuJ6stLzLABeSM5WmD9idNp0

Malware Config

Extracted

Family

spynote

C2

147.185.221.19:21186

Targets

    • Target

      ba2b6a4894af9d7bd10c18abb0c014023ea00e65cd297b3c2e1c3ecb7808867f.bin

    • Size

      760KB

    • MD5

      b0f7e6f1a87b525d0ff8e8d675d34b4f

    • SHA1

      8a912fe7e83efd01e38983ff9e03272aa8ccd7e4

    • SHA256

      ba2b6a4894af9d7bd10c18abb0c014023ea00e65cd297b3c2e1c3ecb7808867f

    • SHA512

      35515f12fe86d8f08c4d5f7eadd3f11e6d9b5262a802e7ccbf7a1db050b966333c9d6db4616a3dce0ac9cd2899d751d8c058ad92be7bdf74d9b4f73d9d4fc08e

    • SSDEEP

      12288:wnjlzlmJ6sgR8LzLx7OB2XSM5WmpYshXZPbGwidNpgb:wnuJ6stLzLABeSM5WmD9idNp0

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

MITRE ATT&CK Matrix

Tasks