General

  • Target

    ready[1].apk

  • Size

    6.2MB

  • Sample

    240731-xfy7xsserh

  • MD5

    ab1e6bf50cd957192900f69439bdd093

  • SHA1

    227b39fc9937ea72a14d08da7727ea779781abd6

  • SHA256

    b5a7a763f22eb95a1b68e998b64562057c69eeec61a5b0115daa9f053ab71d4c

  • SHA512

    076a3ac3c31b9ac7f6e614e95c2278c1f5884eb344488fe06081d6045e00e3a5a8444ce2ab84de60c8aa473561877ccac90b97985d801766aae5d47044b39b79

  • SSDEEP

    24576:e4vFA8nPRVsb6hUid1lAzhvZLlA/Fcg6u4dQZgW:NdbnPRVqjiNAzVZLWdcPI

Malware Config

Extracted

Family

spynote

C2

insurance-helmet.gl.at.ply.gg:31388

Targets

    • Target

      ready[1].apk

    • Size

      6.2MB

    • MD5

      ab1e6bf50cd957192900f69439bdd093

    • SHA1

      227b39fc9937ea72a14d08da7727ea779781abd6

    • SHA256

      b5a7a763f22eb95a1b68e998b64562057c69eeec61a5b0115daa9f053ab71d4c

    • SHA512

      076a3ac3c31b9ac7f6e614e95c2278c1f5884eb344488fe06081d6045e00e3a5a8444ce2ab84de60c8aa473561877ccac90b97985d801766aae5d47044b39b79

    • SSDEEP

      24576:e4vFA8nPRVsb6hUid1lAzhvZLlA/Fcg6u4dQZgW:NdbnPRVqjiNAzVZLWdcPI

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks