General

  • Target

    2fdd7de635cbe2cea317d4007fcf4804.bin

  • Size

    632KB

  • Sample

    240507-bjndyabf6x

  • MD5

    f25e6b5415a35653faecb14d0ff84a8d

  • SHA1

    8c2d15210b6fe0528db3a6be53bc48821783178d

  • SHA256

    69be6c2259cf6ea683b3bf16b97337352f7b94f4a553d945a426d5a417c3ec58

  • SHA512

    6a194b9c2e95f6a57888ef4472e762ce913b4d3621d4ca13b76667cd6f008d406af904764c9b28a83202b262c1d1e13149ca4604e9cf6b6278d2cfcf4bfd4e48

  • SSDEEP

    12288:yx/Mc1HBEb7m3ioXqSvbfISABjNk9H+iR1ypKrVf+7vvefY:y/MccbSSNSjfISABiLRUpSaug

Malware Config

Extracted

Family

spynote

C2

54.36.128.153:7771

Extracted

Family

spynote

C2

54.36.128.153:7771

Targets

    • Target

      566740aa5e33f0ba7b8d8ff447ae9ea961a05b53961feeda26d9bbd3938cf46d.zip

    • Size

      688KB

    • MD5

      2fdd7de635cbe2cea317d4007fcf4804

    • SHA1

      6d6834b0173e3edb35be4ce682daccad4eb553f6

    • SHA256

      566740aa5e33f0ba7b8d8ff447ae9ea961a05b53961feeda26d9bbd3938cf46d

    • SHA512

      27010a63b6927aede0e70a14422a7086e56b4d3392b4caf8930c9157bff874e80fcc91424d896572d9ee79016ca8bc9f9504e1eda7a273549ce41cfbe8e13026

    • SSDEEP

      12288:XUB9DiR3eH70eH4cpkS9oHFryvH4P6usT3cgtN0FZ66Rq21vg0/tWDsfGD:EB9DiR3K70e1iS9wRQH4P6HT3SFZ6GNc

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Schedules tasks to execute at a specified time

      Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

MITRE ATT&CK Mobile v15

Tasks