General

  • Target
    d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
  • Size 5.4MB
  • Sample241111-dld96a1eql
  • SHA256 d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • spynote

C2
  • 91.214.78.18:7771

Targets

    • Target
      d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2.apk
    • Size 5.4MB
    • SHA256 d8438b05118a01791311dcadd84d429191a9975f9afa8310a4a92ade5a2bc4d2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      lariska.apk
    • Size 3.6MB
    • SHA256 f3df45ca4a6184785d56aeca18a3d05422171f962605c503da303209aad7cb8d
    • MD5 SHA1 SHA512 SSDEEP
    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks