General

  • Target

    137d7803cc231f5bdf33a77534f806e441cb2edc2a66efb86a437a7af16b35da.bin

  • Size

    771KB

  • Sample

    240407-1x42aafg4y

  • MD5

    631528a305e26011fe0d5c627e07dd64

  • SHA1

    73e89c56006bb5b224bbb09bb099f2a0a0d0bcb3

  • SHA256

    137d7803cc231f5bdf33a77534f806e441cb2edc2a66efb86a437a7af16b35da

  • SHA512

    3eaee72e0434f44b3b02d547db0e4d18a7ed9415dfee67a46083a968c8c6bec60ba6f77752167061dcdf1c776b1b7590ba50d63ba9b0bbc90fd18b902fc3efff

  • SSDEEP

    12288:gm9ubWZlxi2odwvi/RwncvOKGywi8t6y7fvNldSdyPJ:f9ubsPgw6ucvPGdi8t6efvNidyPJ

Malware Config

Extracted

Family

spynote

C2

147.185.221.19:21186

Targets

    • Target

      137d7803cc231f5bdf33a77534f806e441cb2edc2a66efb86a437a7af16b35da.bin

    • Size

      771KB

    • MD5

      631528a305e26011fe0d5c627e07dd64

    • SHA1

      73e89c56006bb5b224bbb09bb099f2a0a0d0bcb3

    • SHA256

      137d7803cc231f5bdf33a77534f806e441cb2edc2a66efb86a437a7af16b35da

    • SHA512

      3eaee72e0434f44b3b02d547db0e4d18a7ed9415dfee67a46083a968c8c6bec60ba6f77752167061dcdf1c776b1b7590ba50d63ba9b0bbc90fd18b902fc3efff

    • SSDEEP

      12288:gm9ubWZlxi2odwvi/RwncvOKGywi8t6y7fvNldSdyPJ:f9ubsPgw6ucvPGdi8t6efvNidyPJ

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

MITRE ATT&CK Matrix

Tasks