General

  • Target

    Predator (3).apk

  • Size

    3.7MB

  • Sample

    241119-ddx3asvjfn

  • MD5

    6c8f7d51050f8bb76a1ff46dd3f07f0d

  • SHA1

    384775c5a2faa236bb137fefe5549698cb08ea17

  • SHA256

    1ac99cb814584d00805ab124bfec1931a97ee3d583aa08daf4ac80cdc97f43d9

  • SHA512

    083be9d4fc53989ef77ef512561f34724085e1558b64523a5b5f9c9e3ca99f19c0ca821897b029bbc95708a0fcbfb3c359356019a6bdca2f185919501d599b97

  • SSDEEP

    49152:7GAEhhrlkZLGtKzbWRn5RZrzMJ9Sg+ymzLzdGGvQTOujU7Yq50cgMvH4L3yTMgI7:7dUeLdzbWVp/CV+ymzLzBITa0tMvpq

Malware Config

Extracted

Family

spynote

C2

5.42.92.97:7771

Targets

    • Target

      Predator (3).apk

    • Size

      3.7MB

    • MD5

      6c8f7d51050f8bb76a1ff46dd3f07f0d

    • SHA1

      384775c5a2faa236bb137fefe5549698cb08ea17

    • SHA256

      1ac99cb814584d00805ab124bfec1931a97ee3d583aa08daf4ac80cdc97f43d9

    • SHA512

      083be9d4fc53989ef77ef512561f34724085e1558b64523a5b5f9c9e3ca99f19c0ca821897b029bbc95708a0fcbfb3c359356019a6bdca2f185919501d599b97

    • SSDEEP

      49152:7GAEhhrlkZLGtKzbWRn5RZrzMJ9Sg+ymzLzdGGvQTOujU7Yq50cgMvH4L3yTMgI7:7dUeLdzbWVp/CV+ymzLzBITa0tMvpq

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks