General

  • Target

    cce31a5e8f963c5d67f77fce63f009903a8c2eb23afa2e6550a93221c9667b62.bin

  • Size

    760KB

  • Sample

    240712-1zsq2asclp

  • MD5

    70510eb39615e0a8d3d3908d559a7ddf

  • SHA1

    6b473e09969de105b5557d313e27baa9da533d2a

  • SHA256

    cce31a5e8f963c5d67f77fce63f009903a8c2eb23afa2e6550a93221c9667b62

  • SHA512

    89c4712d6b512d956b2bcf4982cbac9b0ac19e490e67def4f0284b2f2cb86c9a857b9d78e8e06dc6950ee172cf17b689082eee343db98f3e7abc1c56ad530d66

  • SSDEEP

    12288:u4dla1a8LzeUT2duC7WTH5WmpYshXZPbGwidNpgO:uMla1ameUeu4WTH5WmD9idNpt

Malware Config

Extracted

Family

spynote

C2

147.185.221.21:6568

Targets

    • Target

      cce31a5e8f963c5d67f77fce63f009903a8c2eb23afa2e6550a93221c9667b62.bin

    • Size

      760KB

    • MD5

      70510eb39615e0a8d3d3908d559a7ddf

    • SHA1

      6b473e09969de105b5557d313e27baa9da533d2a

    • SHA256

      cce31a5e8f963c5d67f77fce63f009903a8c2eb23afa2e6550a93221c9667b62

    • SHA512

      89c4712d6b512d956b2bcf4982cbac9b0ac19e490e67def4f0284b2f2cb86c9a857b9d78e8e06dc6950ee172cf17b689082eee343db98f3e7abc1c56ad530d66

    • SSDEEP

      12288:u4dla1a8LzeUT2duC7WTH5WmpYshXZPbGwidNpgO:uMla1ameUeu4WTH5WmD9idNpt

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

MITRE ATT&CK Mobile v15

Tasks