General

  • Target

    tool.apk

  • Size

    696KB

  • Sample

    241020-ba8nhs1eqr

  • MD5

    1191a942cc593071da75bd9d551c5fff

  • SHA1

    fd138a0a41eeacebbc43bfd50ae315860e643f15

  • SHA256

    2512b551758aa82edc38df3cabb050191ba71e27771a85cd9ee27ad7d0d8b531

  • SHA512

    48d5dd6040d9e75df86d4b993392d55466f608b4ab9cbc4916f2cd0c08718ecc2c7559175fc1188d774fc614ae035df7d0f6404f64328576310e231f9451adcb

  • SSDEEP

    12288:gJ/WU5GyF7rF/igUDXU4FMGDPK+dnHLsdgObAusT3cgtN0F7WA6Rq21YgWOtWDaO:gdD7rpQD3HxHLYdbAHT3SF7WAGNtSaO

Malware Config

Extracted

Family

spynote

C2

call-flip.gl.at.ply.gg:4411

Targets

    • Target

      tool.apk

    • Size

      696KB

    • MD5

      1191a942cc593071da75bd9d551c5fff

    • SHA1

      fd138a0a41eeacebbc43bfd50ae315860e643f15

    • SHA256

      2512b551758aa82edc38df3cabb050191ba71e27771a85cd9ee27ad7d0d8b531

    • SHA512

      48d5dd6040d9e75df86d4b993392d55466f608b4ab9cbc4916f2cd0c08718ecc2c7559175fc1188d774fc614ae035df7d0f6404f64328576310e231f9451adcb

    • SSDEEP

      12288:gJ/WU5GyF7rF/igUDXU4FMGDPK+dnHLsdgObAusT3cgtN0F7WA6Rq21YgWOtWDaO:gdD7rpQD3HxHLYdbAHT3SF7WAGNtSaO

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests enabling of the accessibility settings.

MITRE ATT&CK Mobile v15

Tasks