General

  • Target

    Video Chat.apk

  • Size

    5.5MB

  • Sample

    241119-gda5bawlcq

  • MD5

    66c35ad81878feb1ece06cb9870392cd

  • SHA1

    ff3113b23a0f7c2a202c1a5dbceeb65c2dbc2ed6

  • SHA256

    b4e3ba416a955d2cbd2053ed5d4a946badd73dd47967471d4a01f351ae80551c

  • SHA512

    cecd2cc7f02390fa471d150157b298017d8760a1b00b01a5fa430adc6b42e9023c20ae154d50b46a681f76b88970c2b9aac2cba980d39ed1e0c48c58f49ed35e

  • SSDEEP

    98304:FVfzy6D7MuLaW/yMAQ1yzI75XTtCVzF21n11QzcmzBzBWTk0tlINV4:XWP8jqMAzs75DtKJ2D1ALzaXs4

Malware Config

Extracted

Family

spynote

C2

51.132.229.252:7771

Targets

    • Target

      Video Chat.apk

    • Size

      5.5MB

    • MD5

      66c35ad81878feb1ece06cb9870392cd

    • SHA1

      ff3113b23a0f7c2a202c1a5dbceeb65c2dbc2ed6

    • SHA256

      b4e3ba416a955d2cbd2053ed5d4a946badd73dd47967471d4a01f351ae80551c

    • SHA512

      cecd2cc7f02390fa471d150157b298017d8760a1b00b01a5fa430adc6b42e9023c20ae154d50b46a681f76b88970c2b9aac2cba980d39ed1e0c48c58f49ed35e

    • SSDEEP

      98304:FVfzy6D7MuLaW/yMAQ1yzI75XTtCVzF21n11QzcmzBzBWTk0tlINV4:XWP8jqMAzs75DtKJ2D1ALzaXs4

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks