General

  • Target

    ready.apk

  • Size

    5.5MB

  • Sample

    241031-e4kqbszhkp

  • MD5

    6c6e47e1a51e53eef22b9305abaaf392

  • SHA1

    063fe806f986f5319a9ef4876cfefb59e2cd6f69

  • SHA256

    7126d929d329e5f0fe69290814abbbf57ad2ff35d05de5ef00d0d4b053ac4686

  • SHA512

    573eea6fa065a47ee686997276f69571fa96c86489cdb76e6d5e154a57feb805ec47f4fac9af52a1f8771cec7d7da69df50d05138a76adf3df1f6490b2d47754

  • SSDEEP

    98304:L/wlsLSQoZEYK7S859Xt0yfbTfRTZ89Hwemz5zBYTq0tSYDB:L/wljQTYKR5xzXpTZj5zoJ9

Malware Config

Extracted

Family

spynote

C2

109.107.182.213:7771

Targets

    • Target

      ready.apk

    • Size

      5.5MB

    • MD5

      6c6e47e1a51e53eef22b9305abaaf392

    • SHA1

      063fe806f986f5319a9ef4876cfefb59e2cd6f69

    • SHA256

      7126d929d329e5f0fe69290814abbbf57ad2ff35d05de5ef00d0d4b053ac4686

    • SHA512

      573eea6fa065a47ee686997276f69571fa96c86489cdb76e6d5e154a57feb805ec47f4fac9af52a1f8771cec7d7da69df50d05138a76adf3df1f6490b2d47754

    • SSDEEP

      98304:L/wlsLSQoZEYK7S859Xt0yfbTfRTZ89Hwemz5zBYTq0tSYDB:L/wljQTYKR5xzXpTZj5zoJ9

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks