General

  • Target

    https://www.mediafire.com/file/apszglcaz7fkezf/Head$Trick++Paid.apk/file

  • Sample

    241108-aq91vazqbx

Malware Config

Targets

    • Target

      https://www.mediafire.com/file/apszglcaz7fkezf/Head$Trick++Paid.apk/file

    • Spynote

      Spynote is a Remote Access Trojan first seen in 2017.

    • Spynote family

    • Spynote payload

    • Attempts to obfuscate APK file format

      Applies obfuscation techniques to the APK format in order to hinder analysis

    • Declares broadcast receivers with permission to handle system events

    • Declares services with permission to bind to the system

    • Requests dangerous framework permissions

MITRE ATT&CK Mobile v15

Tasks