General

  • Target

    Gta.apk

  • Size

    720KB

  • Sample

    240429-fr2nrabf3x

  • MD5

    6b4a2a223eadda8e24b39456dfc51e71

  • SHA1

    ad4cf20ad940ea309fbe8688407c4e4790ef2f3d

  • SHA256

    1e7db2759852e04e2cbe3b68e7490489f561b46cd693e2fceb4a61c15a732b9d

  • SHA512

    7d0585d3423b1e6a4f3f96201267debd05f36b720040c51e740dc1cc819c9458ac674b6bea402261956408a08d0503a39c8354f1e816141c8005c155bea0986e

  • SSDEEP

    12288:/btZ7ieCoVBaUt+aLMwyJH9xwBZMIg4z/usT3cgtN0Fj2C6M6Rq21lgxStWD2t:/5cIVsaKZ9xwoIg4z/HT3SFjJ6MGNWLk

Malware Config

Extracted

Family

spynote

C2

31.148.165.61:7771

Targets

    • Target

      Gta.apk

    • Size

      720KB

    • MD5

      6b4a2a223eadda8e24b39456dfc51e71

    • SHA1

      ad4cf20ad940ea309fbe8688407c4e4790ef2f3d

    • SHA256

      1e7db2759852e04e2cbe3b68e7490489f561b46cd693e2fceb4a61c15a732b9d

    • SHA512

      7d0585d3423b1e6a4f3f96201267debd05f36b720040c51e740dc1cc819c9458ac674b6bea402261956408a08d0503a39c8354f1e816141c8005c155bea0986e

    • SSDEEP

      12288:/btZ7ieCoVBaUt+aLMwyJH9xwBZMIg4z/usT3cgtN0Fj2C6M6Rq21lgxStWD2t:/5cIVsaKZ9xwoIg4z/HT3SFjJ6MGNWLk

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

Tasks