General

  • Target

    Headshot GFX Tool and Sensitivity settings Guide_1.0_APKPure.apk

  • Size

    12.8MB

  • Sample

    240701-3xtlnaxgmd

  • MD5

    48ad3d33412a88bebab851a354217c9a

  • SHA1

    3fb058952db67b84663edacb51057d3c0e532585

  • SHA256

    218824ecd6fe20e95ac7fa99e410664afe92576e40c40f55ea16ec53118f964f

  • SHA512

    4d6935792a8813694e3dcf4c6361b3b072e4cc02f0224a823134530ac266b7ac9617da5b3c0359584311b97255fc0e14bebf5836487ba3f68e2a95162b693c42

  • SSDEEP

    393216:t7d0n7G3tfaLMHRG7oODZgNLlKLDE4NDWp:t7d27G3tiYHRUZEKbNap

Malware Config

Extracted

Family

spynote

C2

people-climbing.gl.at.ply.gg:54251

Targets

    • Target

      Headshot GFX Tool and Sensitivity settings Guide_1.0_APKPure.apk

    • Size

      12.8MB

    • MD5

      48ad3d33412a88bebab851a354217c9a

    • SHA1

      3fb058952db67b84663edacb51057d3c0e532585

    • SHA256

      218824ecd6fe20e95ac7fa99e410664afe92576e40c40f55ea16ec53118f964f

    • SHA512

      4d6935792a8813694e3dcf4c6361b3b072e4cc02f0224a823134530ac266b7ac9617da5b3c0359584311b97255fc0e14bebf5836487ba3f68e2a95162b693c42

    • SSDEEP

      393216:t7d0n7G3tfaLMHRG7oODZgNLlKLDE4NDWp:t7d27G3tiYHRUZEKbNap

    • Checks if the Android device is rooted.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

MITRE ATT&CK Mobile v15

Tasks