General

  • Target

    ready.apk

  • Size

    716KB

  • Sample

    240430-ewz52sca77

  • MD5

    86363c1ac93cdc642e22237d4eeb91f5

  • SHA1

    4c85642bdefb0f8435318d86531e6dcbc0afa0d6

  • SHA256

    6a48526d9c1c88b103943d3a126830b53bf35585e113d606160aedce7866ccb7

  • SHA512

    4370adb8b7e73726f572fe5c48572bc06b3df0b3a43eefbb41310a20391434fe58f7f2114f04c9618bb793f9134a703c9cac1df256e70c6ca96a44f181acbbee

  • SSDEEP

    12288:p3Le+c0nLL1KIRYfu50RAenebwMkAucx+edQNw+zusT3cgtN0F606Rq21nJrQg2G:pbFgImfuSR5k5bZdQO+zHT3SF60GNnJb

Malware Config

Extracted

Family

spynote

C2

31.148.165.61:7771

Targets

    • Target

      ready.apk

    • Size

      716KB

    • MD5

      86363c1ac93cdc642e22237d4eeb91f5

    • SHA1

      4c85642bdefb0f8435318d86531e6dcbc0afa0d6

    • SHA256

      6a48526d9c1c88b103943d3a126830b53bf35585e113d606160aedce7866ccb7

    • SHA512

      4370adb8b7e73726f572fe5c48572bc06b3df0b3a43eefbb41310a20391434fe58f7f2114f04c9618bb793f9134a703c9cac1df256e70c6ca96a44f181acbbee

    • SSDEEP

      12288:p3Le+c0nLL1KIRYfu50RAenebwMkAucx+edQNw+zusT3cgtN0F606Rq21nJrQg2G:pbFgImfuSR5k5bZdQO+zHT3SF60GNnJb

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

MITRE ATT&CK Matrix

Tasks