General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    241012-2eav6aygql

  • MD5

    da7e1ade5cf3ab821fbb7391d6b70b5a

  • SHA1

    2b13eeabd3eeb52d4925e1b97299f0cf3fccd102

  • SHA256

    95ebcb66cb42efb7dea173eefefcd17a7bf9dce0d5a34f87769476f288aa3c8c

  • SHA512

    a078f599adb8ed49549e11ae109f4a5af2e4f35dff566ddd855653bf8534583be329f408d8f7fef050f22d474c9514102892e1b7d075f07baf6802319d9744cc

  • SSDEEP

    12288:KAC+gsKa1a8LVekjulKH3v5WmpYshXZPbGwidNpgi:KACHa1aKek2KH3v5WmD9idNpF

Malware Config

Extracted

Family

spynote

C2

45.145.41.251:9595

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      da7e1ade5cf3ab821fbb7391d6b70b5a

    • SHA1

      2b13eeabd3eeb52d4925e1b97299f0cf3fccd102

    • SHA256

      95ebcb66cb42efb7dea173eefefcd17a7bf9dce0d5a34f87769476f288aa3c8c

    • SHA512

      a078f599adb8ed49549e11ae109f4a5af2e4f35dff566ddd855653bf8534583be329f408d8f7fef050f22d474c9514102892e1b7d075f07baf6802319d9744cc

    • SSDEEP

      12288:KAC+gsKa1a8LVekjulKH3v5WmpYshXZPbGwidNpgi:KACHa1aKek2KH3v5WmD9idNpF

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks