General

  • Target

    50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a.zip

  • Size

    14.6MB

  • Sample

    241106-c6kr1asncw

  • MD5

    0ee0fd1549279eebfa63616accb5c6f0

  • SHA1

    b7962c3a23e14019309c3d0ddd20c38cdfdb6dfb

  • SHA256

    50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a

  • SHA512

    cae8e7c18065a94fbbe1e5b7baaed36700835a3fefb4d047416cc9bcb76a354565b2f4cb589116762ad09c48367a6c0f69e947b4f87dbabc80747869f26d9552

  • SSDEEP

    393216:+USo++UEBhPQT75d5Zb8RuI1rhMlIPDNQPa0hAcdylFPqC/Dwxd:TdUZ5dTKuMMlILMrjyHPEd

Malware Config

Extracted

Family

spynote

C2

147.185.221.17:5764

Targets

    • Target

      50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a.zip

    • Size

      14.6MB

    • MD5

      0ee0fd1549279eebfa63616accb5c6f0

    • SHA1

      b7962c3a23e14019309c3d0ddd20c38cdfdb6dfb

    • SHA256

      50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a

    • SHA512

      cae8e7c18065a94fbbe1e5b7baaed36700835a3fefb4d047416cc9bcb76a354565b2f4cb589116762ad09c48367a6c0f69e947b4f87dbabc80747869f26d9552

    • SSDEEP

      393216:+USo++UEBhPQT75d5Zb8RuI1rhMlIPDNQPa0hAcdylFPqC/Dwxd:TdUZ5dTKuMMlILMrjyHPEd

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the mobile country code (MCC)

MITRE ATT&CK Mobile v15

Tasks