General
-
Target
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5.zip
-
Size
12.1MB
-
Sample
241106-dlm73asqbz
-
MD5
f0b5a0a0437867b234da31dcb57b511a
-
SHA1
a1ed48017766c9581ecbb9682ac87db0f25382a8
-
SHA256
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5
-
SHA512
71dd8465c8f56bfa0cfa58502fc6e1d3d519a53a4f99600f72b410a4cf881ebc892ca550032b5523115cfd2e00bb0b63ec4861781b6fde43606232e2378ba0f4
-
SSDEEP
98304:gm+Qx2blgIQUX2zy/fmzHzBdTv0twjkjyDPV+L43l1LD/VOFFYRs4GKvuNKXctPQ:94bQs2zy2zjgSslGP2bryiK4Q
Behavioral task
behavioral1
Sample
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
childapp.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
childapp.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral6
Sample
childapp.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
spynote
3.tcp.ngrok.io:23649
Targets
-
-
Target
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5.zip
-
Size
12.1MB
-
MD5
f0b5a0a0437867b234da31dcb57b511a
-
SHA1
a1ed48017766c9581ecbb9682ac87db0f25382a8
-
SHA256
8d0d5320c9016316de26412f32bb92a988e9c967ed83bae0b2de36d5b953e0a5
-
SHA512
71dd8465c8f56bfa0cfa58502fc6e1d3d519a53a4f99600f72b410a4cf881ebc892ca550032b5523115cfd2e00bb0b63ec4861781b6fde43606232e2378ba0f4
-
SSDEEP
98304:gm+Qx2blgIQUX2zy/fmzHzBdTv0twjkjyDPV+L43l1LD/VOFFYRs4GKvuNKXctPQ:94bQs2zy2zjgSslGP2bryiK4Q
Score1/10 -
-
-
Target
childapp.apk
-
Size
8.5MB
-
MD5
ff748bdc4fcb780b1b70236b7d8bf539
-
SHA1
35e580c0e3c1859a8cad0fe61f02643b71d0194c
-
SHA256
e2da21729f6299aa0802d8338803b899373891c1f906c0522b8d385392503673
-
SHA512
d8487c3a738e5d867c7d4e24607fe0cac2093fea09e218786bf95633a73854acc9aa8f8dc3a53d7c3e8ca077bbcb3869a7bc4c10c5305e14ae987d5ec029b393
-
SSDEEP
49152:km1m+8pMrS90PP+u5f1M8tlGKO5dtVd6QK3PP9Mzy/S7KmzHzdGGyQTOOZwUgYqz:vm+Qx2blgIQUX2zy/fmzHzBdTv0twj0
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Legitimate hosting services abused for malware hosting/C2
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1