General

  • Target

    ready.apk

  • Size

    36KB

  • Sample

    241221-prphvszmbl

  • MD5

    b6f451f98a04c25d2a96d65162466b39

  • SHA1

    44a79222e580a597d35d6ed7e8f332f7ec95dacb

  • SHA256

    2bc8f204b1eced2067893442bcb644f5d8c78495a3eb484a9aa01a17d15a2b08

  • SHA512

    7ee9204fb3166b0ad111e780e5d0edccabb0ebf2eba1f24628225ef5a0ba4d07faa4ad3c51a8652ddda10b4a8245947528d236d510a1c46e9138857d6bca1cde

  • SSDEEP

    768:OWyAOZrJFU/bZzQqjhlEI52+qngoHv2sQ3udNgUwPUMO8828Dp0QdxDG:OWyDZGFpNld52+qnXPpUW/y9O8828m

Malware Config

Extracted

Family

spymax

C2

science-attract.gl.at.ply.gg:13548

Targets

    • Target

      ready.apk

    • Size

      36KB

    • MD5

      b6f451f98a04c25d2a96d65162466b39

    • SHA1

      44a79222e580a597d35d6ed7e8f332f7ec95dacb

    • SHA256

      2bc8f204b1eced2067893442bcb644f5d8c78495a3eb484a9aa01a17d15a2b08

    • SHA512

      7ee9204fb3166b0ad111e780e5d0edccabb0ebf2eba1f24628225ef5a0ba4d07faa4ad3c51a8652ddda10b4a8245947528d236d510a1c46e9138857d6bca1cde

    • SSDEEP

      768:OWyAOZrJFU/bZzQqjhlEI52+qngoHv2sQ3udNgUwPUMO8828Dp0QdxDG:OWyDZGFpNld52+qnXPpUW/y9O8828m

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Reads the content of the call log.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

MITRE ATT&CK Mobile v15

Tasks