Resubmissions

20-01-2025 20:03

250120-ys6m7swqan 10

20-01-2025 20:01

250120-yr2mvswpcn 10

General

  • Target

    ready.apk

  • Size

    8.5MB

  • Sample

    250120-yr2mvswpcn

  • MD5

    24bb01d9bc70667e7da7641ed26b9b28

  • SHA1

    2825b1c6ab56e61343a645e48dd58cb310500b66

  • SHA256

    e366177bf0f05a8c947711892d05c84ae95b016bd7312e7f66b049b78664b021

  • SHA512

    cf1065a7d9c6ab8e8b3b33d19b23f120a2f48dc85860fc3661d78712e352d3c1a4d89a4c5af078149dd3ed2aa89d5ec1790e81c06317998508721b96f1060297

  • SSDEEP

    49152:CIGVmCqeep0p5vlAiFoJwJYz48CTV0odnTMKVGwAmzhzdGGgQTO1TUcYqz0cga11:FGMo7IwJYkBiodDGLmzhzBXTa0tab

Malware Config

Extracted

Family

spynote

C2

niewiemcodac.ddns.net:2137

Targets

    • Target

      ready.apk

    • Size

      8.5MB

    • MD5

      24bb01d9bc70667e7da7641ed26b9b28

    • SHA1

      2825b1c6ab56e61343a645e48dd58cb310500b66

    • SHA256

      e366177bf0f05a8c947711892d05c84ae95b016bd7312e7f66b049b78664b021

    • SHA512

      cf1065a7d9c6ab8e8b3b33d19b23f120a2f48dc85860fc3661d78712e352d3c1a4d89a4c5af078149dd3ed2aa89d5ec1790e81c06317998508721b96f1060297

    • SSDEEP

      49152:CIGVmCqeep0p5vlAiFoJwJYz48CTV0odnTMKVGwAmzhzdGGgQTO1TUcYqz0cga11:FGMo7IwJYkBiodDGLmzhzBXTa0tab

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

MITRE ATT&CK Mobile v15

Tasks