General

  • Target

    24ecddd58b2f4c310daa76b8ede57c5f94e168471a371790c1daef74ac0bde0b.bin

  • Size

    760KB

  • Sample

    241207-1yxctswmfy

  • MD5

    6dc573589acf8ac8092092202f58d4ed

  • SHA1

    750b6635c21b4769e710c30c1c10558bd637838d

  • SHA256

    24ecddd58b2f4c310daa76b8ede57c5f94e168471a371790c1daef74ac0bde0b

  • SHA512

    d0a85cc77622db4f3659add2d45c4d1323ded8aa5f3cdfab41d471f590da0dbd1465e78e44cbebbfe062eaed57eb564ed382c96636b1232c8a29ef3ce9225768

  • SSDEEP

    12288:26oJ6sgR8Lz5dxgv5Uq5WmpYshXZPbGwidNpgPU:6J6s1Lz5cv5Uq5WmD9idNp+U

Malware Config

Extracted

Family

spynote

C2

127.0.0.1:2525:20342

Targets

    • Target

      24ecddd58b2f4c310daa76b8ede57c5f94e168471a371790c1daef74ac0bde0b.bin

    • Size

      760KB

    • MD5

      6dc573589acf8ac8092092202f58d4ed

    • SHA1

      750b6635c21b4769e710c30c1c10558bd637838d

    • SHA256

      24ecddd58b2f4c310daa76b8ede57c5f94e168471a371790c1daef74ac0bde0b

    • SHA512

      d0a85cc77622db4f3659add2d45c4d1323ded8aa5f3cdfab41d471f590da0dbd1465e78e44cbebbfe062eaed57eb564ed382c96636b1232c8a29ef3ce9225768

    • SSDEEP

      12288:26oJ6sgR8Lz5dxgv5Uq5WmpYshXZPbGwidNpgPU:6J6s1Lz5cv5Uq5WmD9idNp+U

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks