General

  • Target

    ready.apk

  • Size

    36KB

  • Sample

    241221-p2npbazmav

  • MD5

    33b57418439c6a8fab64f4a0dae839ab

  • SHA1

    63d27a1a21f6141489e0f2340bbac894fd00b674

  • SHA256

    e3833ab66b8fccbd9b2368618697c063a9e812c6e3d95589e9dffa700d902069

  • SHA512

    16bbdb0c7c457529d86817ecba322546fbd78bc0fcc643e808b1a875d8663915e7d80e43b6bf750cdcfabebf753c6fecb73d7db3185691655cba669dfcfe6de3

  • SSDEEP

    768:3wDLUokFU/bZzVsxngiC029Y/jceTf53dsNXdeNoE0:YRFRwngiCNez5tENnE0

Malware Config

Extracted

Family

spymax

C2

science-attract.gl.at.ply.gg:13548

Targets

    • Target

      ready.apk

    • Size

      36KB

    • MD5

      33b57418439c6a8fab64f4a0dae839ab

    • SHA1

      63d27a1a21f6141489e0f2340bbac894fd00b674

    • SHA256

      e3833ab66b8fccbd9b2368618697c063a9e812c6e3d95589e9dffa700d902069

    • SHA512

      16bbdb0c7c457529d86817ecba322546fbd78bc0fcc643e808b1a875d8663915e7d80e43b6bf750cdcfabebf753c6fecb73d7db3185691655cba669dfcfe6de3

    • SSDEEP

      768:3wDLUokFU/bZzVsxngiC029Y/jceTf53dsNXdeNoE0:YRFRwngiCNez5tENnE0

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes a phone call.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

MITRE ATT&CK Mobile v15

Tasks