General

  • Target

    ready.apk

  • Size

    8.7MB

  • Sample

    241114-j7vrxszlbl

  • MD5

    7a465eebf6d268f7165d9a79dbcbb6f4

  • SHA1

    d9b3b557bd5d0ecba7f87a741a7c3157dd24944a

  • SHA256

    016bba49b3dbf216912ec842fd54a38286dda28f45d47c7cfcfaf1daa3ee9796

  • SHA512

    001d206e570249667e3c6ab99382ba9a8adabeb97cd09ae591eba9e8ab0f0c75f030a385c65bef39c49fdae522c6f36d39c663152be18b3111d8113b8ca8daaf

  • SSDEEP

    98304:f9rSIwKT4h8e3zFDOq1i83/AImzxzBZTs0tJkx3Q:1rSIwKTqRDDZ43zF/0Q

Malware Config

Extracted

Family

spynote

C2

department-fat.gl.at.ply.gg:32388

Targets

    • Target

      ready.apk

    • Size

      8.7MB

    • MD5

      7a465eebf6d268f7165d9a79dbcbb6f4

    • SHA1

      d9b3b557bd5d0ecba7f87a741a7c3157dd24944a

    • SHA256

      016bba49b3dbf216912ec842fd54a38286dda28f45d47c7cfcfaf1daa3ee9796

    • SHA512

      001d206e570249667e3c6ab99382ba9a8adabeb97cd09ae591eba9e8ab0f0c75f030a385c65bef39c49fdae522c6f36d39c663152be18b3111d8113b8ca8daaf

    • SSDEEP

      98304:f9rSIwKT4h8e3zFDOq1i83/AImzxzBZTs0tJkx3Q:1rSIwKTqRDDZ43zF/0Q

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks