General

  • Target

    Adobe.apk

  • Size

    6.2MB

  • Sample

    250214-h1vynsxlbs

  • MD5

    02ec3e67453ef5c466cde8a55f095a2e

  • SHA1

    ebd228ef8699475700cd43f102557f4d207df94f

  • SHA256

    79bf103ab57bfc8aa75314210e804af7172b64531272e76d32a979941961135f

  • SHA512

    948909555d1de799f364ff0db4fbf151cba36c0994afd89fb28b16ca403dfa5e21c0ba1a5351a0569180efa451e9140e308468b971988fed5f6455b848f2a7ca

  • SSDEEP

    24576:wHDJ2fcso0nE+sqsvo3by7ILeVWOrL8FWYtDH/m:gDMfRfZsAryckdrLi+

Malware Config

Extracted

Family

spynote

C2

127.0.0.1:4444

Targets

    • Target

      Adobe.apk

    • Size

      6.2MB

    • MD5

      02ec3e67453ef5c466cde8a55f095a2e

    • SHA1

      ebd228ef8699475700cd43f102557f4d207df94f

    • SHA256

      79bf103ab57bfc8aa75314210e804af7172b64531272e76d32a979941961135f

    • SHA512

      948909555d1de799f364ff0db4fbf151cba36c0994afd89fb28b16ca403dfa5e21c0ba1a5351a0569180efa451e9140e308468b971988fed5f6455b848f2a7ca

    • SSDEEP

      24576:wHDJ2fcso0nE+sqsvo3by7ILeVWOrL8FWYtDH/m:gDMfRfZsAryckdrLi+

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks