General

  • Target

    3245f017ca55ecd3c124de787165f91b76cfd1118c9b77553d673f970e781d2a.bin

  • Size

    760KB

  • Sample

    240726-1xf98a1aqa

  • MD5

    31bf3f6b0fe0028e650a71261d684ff6

  • SHA1

    252bebb00035bd2d4aee664c1f0e7bd87000231b

  • SHA256

    3245f017ca55ecd3c124de787165f91b76cfd1118c9b77553d673f970e781d2a

  • SHA512

    92be34caf88b6161d0c35bd67ce4e4dc3160231dc89d6a47041de91e904bda0d29727599306da121e4ef190b42091a773f8869c877210ca799180c0bb477d570

  • SSDEEP

    12288:dggFLua1a8LdeTl7GVtO05WmpYshXZPbGwidNpgY:d7Lua1a6eTMVtO05WmD9idNp3

Malware Config

Extracted

Family

spynote

C2

response-notice.gl.at.ply.gg:33487

Targets

    • Target

      3245f017ca55ecd3c124de787165f91b76cfd1118c9b77553d673f970e781d2a.bin

    • Size

      760KB

    • MD5

      31bf3f6b0fe0028e650a71261d684ff6

    • SHA1

      252bebb00035bd2d4aee664c1f0e7bd87000231b

    • SHA256

      3245f017ca55ecd3c124de787165f91b76cfd1118c9b77553d673f970e781d2a

    • SHA512

      92be34caf88b6161d0c35bd67ce4e4dc3160231dc89d6a47041de91e904bda0d29727599306da121e4ef190b42091a773f8869c877210ca799180c0bb477d570

    • SSDEEP

      12288:dggFLua1a8LdeTl7GVtO05WmpYshXZPbGwidNpgY:d7Lua1a6eTMVtO05WmD9idNp3

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Matrix

Tasks