General

  • Target

    8895a9e7124736df09254dbcc5937c750d4a0b163fe7de188d48d8d0aa35edf6.bin

  • Size

    760KB

  • Sample

    250102-1x8z8szqej

  • MD5

    7db30c21af70762a40fa82836c134512

  • SHA1

    d5d4e6464998375ac84b8e944066c882ad5ee544

  • SHA256

    8895a9e7124736df09254dbcc5937c750d4a0b163fe7de188d48d8d0aa35edf6

  • SHA512

    2585a93837b03d7c90343342face4782cbe45ac01164a063c9fa5b3ebf1022a28c50c8b0165d860eb514bb41203594591d45b5d5c3d416b7517728c5ddb84cfa

  • SSDEEP

    12288:SrD1Jca1a8LzeYTediDLn5WmpYshXZPbGwidNpgmd:SrDEa1ameYyiDLn5WmD9idNpd

Malware Config

Extracted

Family

spynote

C2

http://127.0.0.1:4040

Targets

    • Target

      8895a9e7124736df09254dbcc5937c750d4a0b163fe7de188d48d8d0aa35edf6.bin

    • Size

      760KB

    • MD5

      7db30c21af70762a40fa82836c134512

    • SHA1

      d5d4e6464998375ac84b8e944066c882ad5ee544

    • SHA256

      8895a9e7124736df09254dbcc5937c750d4a0b163fe7de188d48d8d0aa35edf6

    • SHA512

      2585a93837b03d7c90343342face4782cbe45ac01164a063c9fa5b3ebf1022a28c50c8b0165d860eb514bb41203594591d45b5d5c3d416b7517728c5ddb84cfa

    • SSDEEP

      12288:SrD1Jca1a8LzeYTediDLn5WmpYshXZPbGwidNpgmd:SrDEa1ameYyiDLn5WmD9idNpd

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks