General

  • Target

    ready.apk

  • Size

    8.6MB

  • Sample

    241203-p8s8da1rer

  • MD5

    957a17d22cd95f08538c110dbe75cbac

  • SHA1

    36de5d6b0a0391ba292488e90be11bf045ad8eb8

  • SHA256

    6d316ee0f968cb999f17bb7ffcde4557c9a4e5bd56e50547e3a95682f86b4fb5

  • SHA512

    4a8f4b0353edefa8ce0e2b8c8bbf097d907de1b7e3e89897bcf76b509c8bd07eb7bbbf1efc2f292808e362140b02a42fed3dbb05af14663b999b153beca5cc4e

  • SSDEEP

    98304:3XBWxKvQVAP2pMt67M6sumznzB6T90t4HR2GE:gxg4AXM77spzsy7

Malware Config

Extracted

Family

spynote

C2

147.185.221.20:17798

Targets

    • Target

      ready.apk

    • Size

      8.6MB

    • MD5

      957a17d22cd95f08538c110dbe75cbac

    • SHA1

      36de5d6b0a0391ba292488e90be11bf045ad8eb8

    • SHA256

      6d316ee0f968cb999f17bb7ffcde4557c9a4e5bd56e50547e3a95682f86b4fb5

    • SHA512

      4a8f4b0353edefa8ce0e2b8c8bbf097d907de1b7e3e89897bcf76b509c8bd07eb7bbbf1efc2f292808e362140b02a42fed3dbb05af14663b999b153beca5cc4e

    • SSDEEP

      98304:3XBWxKvQVAP2pMt67M6sumznzB6T90t4HR2GE:gxg4AXM77spzsy7

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests enabling of the accessibility settings.

MITRE ATT&CK Mobile v15

Tasks