General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    241010-3kxgsaxgln

  • MD5

    66270fc1ebaff194ac4d0b327d8455fb

  • SHA1

    393fb7b7e929a3cc606b4567442d3675cea3c134

  • SHA256

    56cf855e8c2df6954e1450f72675e3fc4db220528300246b0d13d1c0e130c095

  • SHA512

    a7531fee017032f27a9d19af8790013f24910037a960d5a63c8e86fefcdfb9aad3087c3e408e8ac83b93d7fc507a63378589642c2941e63a15352d9a9a6207e4

  • SSDEEP

    12288:dmfGF0a1a8LrePvDPD48+5WmpYshXZPbGwidNpgu:dga1a2ePTD48+5WmD9idNpl

Malware Config

Extracted

Family

spynote

C2

Ezling-25441.portmap.host:25441

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      66270fc1ebaff194ac4d0b327d8455fb

    • SHA1

      393fb7b7e929a3cc606b4567442d3675cea3c134

    • SHA256

      56cf855e8c2df6954e1450f72675e3fc4db220528300246b0d13d1c0e130c095

    • SHA512

      a7531fee017032f27a9d19af8790013f24910037a960d5a63c8e86fefcdfb9aad3087c3e408e8ac83b93d7fc507a63378589642c2941e63a15352d9a9a6207e4

    • SSDEEP

      12288:dmfGF0a1a8LrePvDPD48+5WmpYshXZPbGwidNpgu:dga1a2ePTD48+5WmD9idNpl

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks