General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    241009-dyd5xsthla

  • MD5

    57854c82668394ad82bd8ad9a5fec9bb

  • SHA1

    30b5cc3ea5aa5b7b870e87c9be8ac782f62e9c7a

  • SHA256

    e533b6ce6aa75f20f070e9538f0b6739d013965edf6effbe0c853a59c9d5235e

  • SHA512

    631fb9c870e45e0bf307bb92758d96e719bc829493ab7f07bda7687844cf32070cc1c5ad689ffae76adafb634dc6d6ff763ec1c8efe50f3ac308e8716b9b9a77

  • SSDEEP

    12288:BqoDMa1a8LregLuTGF7D5WmpYshXZPbGwidNpgv:Bca1a2egAGF7D5WmD9idNp4

Malware Config

Extracted

Family

spynote

C2

Ezling-25441.portmap.host:25441

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      57854c82668394ad82bd8ad9a5fec9bb

    • SHA1

      30b5cc3ea5aa5b7b870e87c9be8ac782f62e9c7a

    • SHA256

      e533b6ce6aa75f20f070e9538f0b6739d013965edf6effbe0c853a59c9d5235e

    • SHA512

      631fb9c870e45e0bf307bb92758d96e719bc829493ab7f07bda7687844cf32070cc1c5ad689ffae76adafb634dc6d6ff763ec1c8efe50f3ac308e8716b9b9a77

    • SSDEEP

      12288:BqoDMa1a8LregLuTGF7D5WmpYshXZPbGwidNpgv:Bca1a2egAGF7D5WmD9idNp4

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks