General

  • Target

    dichvucong.apk

  • Size

    3.7MB

  • Sample

    241105-kh694axlgt

  • MD5

    cf5d143826ef6d50a184c6e5d06349c4

  • SHA1

    5467de524cc720f6144586c1ce93776fa8306aac

  • SHA256

    e23f0cc174648fc57ab64d6f63f63c5a77c3307798cc3aeadba5ef1753bd3815

  • SHA512

    a8f030729f8436d47bda2eb1609714b3a3ec6f6906cf65624743899a072ee7e9eb094146796e57940cea5fbd4752181144fabbeaecb855279b2a460ea4e199a2

  • SSDEEP

    98304:VE00uJ+xP+p4uyn0P0y8DRIoXnRmmzvzBtT+0tMK2:y006P2nKJ8NI6zrle

Malware Config

Extracted

Family

spynote

C2

157.10.203.155:7771

Targets

    • Target

      dichvucong.apk

    • Size

      3.7MB

    • MD5

      cf5d143826ef6d50a184c6e5d06349c4

    • SHA1

      5467de524cc720f6144586c1ce93776fa8306aac

    • SHA256

      e23f0cc174648fc57ab64d6f63f63c5a77c3307798cc3aeadba5ef1753bd3815

    • SHA512

      a8f030729f8436d47bda2eb1609714b3a3ec6f6906cf65624743899a072ee7e9eb094146796e57940cea5fbd4752181144fabbeaecb855279b2a460ea4e199a2

    • SSDEEP

      98304:VE00uJ+xP+p4uyn0P0y8DRIoXnRmmzvzBtT+0tMK2:y006P2nKJ8NI6zrle

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks