General

  • Target

    14b46785ffce883201e2a984ffc0028d59a75aaf5dd94b6922e2abb037837260.bin

  • Size

    760KB

  • Sample

    241208-1w57ysvmbw

  • MD5

    df11ebe00fa7f385472dc3f4c81b65bf

  • SHA1

    457dd26c8e3e5ed2ad34d69328e473f9d852e4cb

  • SHA256

    14b46785ffce883201e2a984ffc0028d59a75aaf5dd94b6922e2abb037837260

  • SHA512

    196bf4eebe5a7ebaec2dcc0695a033caae68c7e58dd6e246a390c69cb160ca850a6ac39863ffacbdf890ecf05decd79e187fe0e36ba47363a28531ff5d75d2a1

  • SSDEEP

    12288:BrVqNnya1a8Ldeobu3aLPb5WmpYshXZPbGwidNpgaea:BrVna1a6eocaLPb5WmD9idNpP

Malware Config

Extracted

Family

spynote

C2

10.8.70.118:4586

Targets

    • Target

      14b46785ffce883201e2a984ffc0028d59a75aaf5dd94b6922e2abb037837260.bin

    • Size

      760KB

    • MD5

      df11ebe00fa7f385472dc3f4c81b65bf

    • SHA1

      457dd26c8e3e5ed2ad34d69328e473f9d852e4cb

    • SHA256

      14b46785ffce883201e2a984ffc0028d59a75aaf5dd94b6922e2abb037837260

    • SHA512

      196bf4eebe5a7ebaec2dcc0695a033caae68c7e58dd6e246a390c69cb160ca850a6ac39863ffacbdf890ecf05decd79e187fe0e36ba47363a28531ff5d75d2a1

    • SSDEEP

      12288:BrVqNnya1a8Ldeobu3aLPb5WmpYshXZPbGwidNpgaea:BrVna1a6eocaLPb5WmD9idNpP

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks