General

  • Target

    e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0.apk

  • Size

    760KB

  • Sample

    250209-dkpdqstjes

  • MD5

    68209d4a9410b15560cdf44ab6f091de

  • SHA1

    6cc25cf379f64355cae4ea8b50e0db2257a0b010

  • SHA256

    e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0

  • SHA512

    dc185f78aac9faccd27b200dad7bd4fd75aba150ffa6189aad257e4a8543684358eb14a4551f862764dd5150446b89ca79f25a52e5f3cd9a26e0ad251050c1ca

  • SSDEEP

    12288:FWk20a1a8LVevr7TrUky5WmpYshXZPbGwidNpgSDHb:FNa1aKevzrUky5WmD9idNpL

Malware Config

Extracted

Family

spynote

C2

solution-athens.gl.at.ply.gg:58433

Targets

    • Target

      e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0.apk

    • Size

      760KB

    • MD5

      68209d4a9410b15560cdf44ab6f091de

    • SHA1

      6cc25cf379f64355cae4ea8b50e0db2257a0b010

    • SHA256

      e1a7b41910ea73b4b5bc4108c4f9ff7a842bedc7fb18f2c3497665942a51c6f0

    • SHA512

      dc185f78aac9faccd27b200dad7bd4fd75aba150ffa6189aad257e4a8543684358eb14a4551f862764dd5150446b89ca79f25a52e5f3cd9a26e0ad251050c1ca

    • SSDEEP

      12288:FWk20a1a8LVevr7TrUky5WmpYshXZPbGwidNpgSDHb:FNa1aKevzrUky5WmD9idNpL

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks