General

  • Target

    Standoff2.apk

  • Size

    893KB

  • Sample

    250126-sp2beswmbm

  • MD5

    811a9f758ba8877a2100bab8c0b474af

  • SHA1

    0a33f417d5b2feb6eba1954cbabeb1bc3f4a4951

  • SHA256

    33eefacdb698fbfd0387df418b4c3e7b9c52f720079af12f72060f5c2bce6946

  • SHA512

    b6b1fa95d078d458e2f1ab278826acc176344ea7cc143575685d5ccc86fca12e9517632be2e3c43ca4f5a1edfad55b1168403310b27b587e85d46acc1b9f4294

  • SSDEEP

    24576:cMrCuT3J6s1LzprgTVxY/yJk/Bp5WmD9idNp5:nuuzJ6sTrEVSqu9Wk0d/5

Malware Config

Extracted

Family

spynote

C2

further-lace.gl.at.ply.gg:18830

Targets

    • Target

      Standoff2.apk

    • Size

      893KB

    • MD5

      811a9f758ba8877a2100bab8c0b474af

    • SHA1

      0a33f417d5b2feb6eba1954cbabeb1bc3f4a4951

    • SHA256

      33eefacdb698fbfd0387df418b4c3e7b9c52f720079af12f72060f5c2bce6946

    • SHA512

      b6b1fa95d078d458e2f1ab278826acc176344ea7cc143575685d5ccc86fca12e9517632be2e3c43ca4f5a1edfad55b1168403310b27b587e85d46acc1b9f4294

    • SSDEEP

      24576:cMrCuT3J6s1LzprgTVxY/yJk/Bp5WmD9idNp5:nuuzJ6sTrEVSqu9Wk0d/5

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks