General

  • Target

    ready.apk

  • Size

    30.0MB

  • Sample

    241023-skmx8sydnm

  • MD5

    fe30c5244d8c0dcd120bad0ae5a5a6fe

  • SHA1

    baffcc6ef4f1888b16a6c0c1d88814bd048a77e6

  • SHA256

    4b01ec065b4cd922e567193200bbaf1f22cf55a29a9d770e645a01e266e1b04f

  • SHA512

    6bf6562dadfe963aac6f76723d7afa9361c9261d7522d891905f5d759243881390757ccf956bbdf81212d2d8f1f1ef8443c2f8a179803b8ce56959ec749ac717

  • SSDEEP

    12288:tw6ngF8WhKT8IizVJ7VulZMPh585XNLusT3cgtN0F346Rq21hg0QtWDrQd:U8WhK5ipcZMPh5OLHT3SF34GNSKrI

Malware Config

Extracted

Family

spynote

C2

192.168.1.2:7771

Extracted

Family

spynote

C2

192.168.1.2:7771

Targets

    • Target

      ready.apk

    • Size

      30.0MB

    • MD5

      fe30c5244d8c0dcd120bad0ae5a5a6fe

    • SHA1

      baffcc6ef4f1888b16a6c0c1d88814bd048a77e6

    • SHA256

      4b01ec065b4cd922e567193200bbaf1f22cf55a29a9d770e645a01e266e1b04f

    • SHA512

      6bf6562dadfe963aac6f76723d7afa9361c9261d7522d891905f5d759243881390757ccf956bbdf81212d2d8f1f1ef8443c2f8a179803b8ce56959ec749ac717

    • SSDEEP

      12288:tw6ngF8WhKT8IizVJ7VulZMPh585XNLusT3cgtN0F346Rq21hg0QtWDrQd:U8WhK5ipcZMPh5OLHT3SF34GNSKrI

    • Removes its main activity from the application launcher

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks