General

  • Target

    e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0.zip

  • Size

    480KB

  • Sample

    250208-wryj4axme1

  • MD5

    695afdefa606fe4783c601a97a69e14e

  • SHA1

    78ef34b431ef090afcd53bde064ff06d34feab45

  • SHA256

    f7491fa6b0798fae9fc822e4c43e9d6e1ba6bf1f853c1802ab8310813eecf3e0

  • SHA512

    fde8627b5845b2f3477a6eea47bd3da181bd0951c0d89ff57dd208b2d1733c13d47f6579d95f87d37ae08662cbe8067961c1957b023e857d751444b701ad89f8

  • SSDEEP

    12288:EvmcDQGbLR+hmqo8bkQEhgTAtE8gUQ/CObCaRL:EvvDfL0TomoN6qO9

Malware Config

Extracted

Family

spynote

C2

solution-athens.gl.at.ply.gg:58433

Targets

    • Target

      e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0.apk

    • Size

      760KB

    • MD5

      68209d4a9410b15560cdf44ab6f091de

    • SHA1

      6cc25cf379f64355cae4ea8b50e0db2257a0b010

    • SHA256

      e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0

    • SHA512

      dc185f78aac9faccd27b200dad7bd4fd75aba150ffa6189aad257e4a8543684358eb14a4551f862764dd5150446b89ca79f25a52e5f3cd9a26e0ad251050c1ca

    • SSDEEP

      12288:FWk20a1a8LVevr7TrUky5WmpYshXZPbGwidNpgSDHb:FNa1aKevzrUky5WmD9idNpL

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks