General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    241012-2hqe1svenh

  • MD5

    0da182785d579682fbd0ae153a05dffd

  • SHA1

    f969122897ebd0d46a434ef8a122bd9ee9b66b5f

  • SHA256

    529f721e9de389b2f23a360aa4bbdf085f3aafc728dfeba2cf4ddb2e18daa56a

  • SHA512

    8615ff735b51210b108669f64fdc0696eee0d9709cf6101ff80be3a5011feef4c78a8d059417a9f8441ef5b60a04ba3648b8cea08a55c8e5a3f4ef8dd6c49957

  • SSDEEP

    12288:PbC+REFa1a8LVeV3R95AGs5WmpYshXZPbGwidNpgg:PbCfa1aKeVH5AGs5WmD9idNpz

Malware Config

Extracted

Family

spynote

C2

45.145.41.251:9595

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      0da182785d579682fbd0ae153a05dffd

    • SHA1

      f969122897ebd0d46a434ef8a122bd9ee9b66b5f

    • SHA256

      529f721e9de389b2f23a360aa4bbdf085f3aafc728dfeba2cf4ddb2e18daa56a

    • SHA512

      8615ff735b51210b108669f64fdc0696eee0d9709cf6101ff80be3a5011feef4c78a8d059417a9f8441ef5b60a04ba3648b8cea08a55c8e5a3f4ef8dd6c49957

    • SSDEEP

      12288:PbC+REFa1a8LVeV3R95AGs5WmpYshXZPbGwidNpgg:PbCfa1aKeVH5AGs5WmD9idNpz

    • Removes its main activity from the application launcher

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks