General

  • Target

    Grab n Go v2.apk (1).apk

  • Size

    18.7MB

  • Sample

    241216-ke9wtasmgx

  • MD5

    de99a5fb0677f53649bd0826ce609f91

  • SHA1

    4e1f874c2193d675265dc1789b3cb5cc7ea230e9

  • SHA256

    a8ef185541bbb0523e5408cdc27c8185945a753d6f29b70827c26239a3ed9159

  • SHA512

    77d93cbadade8f398f53699d75257478d83fe94bd252bdfacf225b51ddac166b068d8d888f310b61556c42ea13fe130dd0502e9deeb9015d94a06ce0bd8d9b8b

  • SSDEEP

    12288:Q+cZYSfpLpf3OtG93iEyf1TNJNwopthcuCkF3izP1rgU7EnbTQDsdtviqd+WtlL0:4fmt23iZ1TNJ/fhcuR3+d0UATXgiwWC

Malware Config

Extracted

Family

spynote

C2

156.240.111.65:1151

Targets

    • Target

      Grab n Go v2.apk (1).apk

    • Size

      18.7MB

    • MD5

      de99a5fb0677f53649bd0826ce609f91

    • SHA1

      4e1f874c2193d675265dc1789b3cb5cc7ea230e9

    • SHA256

      a8ef185541bbb0523e5408cdc27c8185945a753d6f29b70827c26239a3ed9159

    • SHA512

      77d93cbadade8f398f53699d75257478d83fe94bd252bdfacf225b51ddac166b068d8d888f310b61556c42ea13fe130dd0502e9deeb9015d94a06ce0bd8d9b8b

    • SSDEEP

      12288:Q+cZYSfpLpf3OtG93iEyf1TNJNwopthcuCkF3izP1rgU7EnbTQDsdtviqd+WtlL0:4fmt23iZ1TNJ/fhcuR3+d0UATXgiwWC

    • Removes its main activity from the application launcher

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks