General

  • Target

    ready.apk

  • Size

    6.2MB

  • Sample

    250214-h5htxaxmbs

  • MD5

    15e8d18bfe1409173af0a38fce654109

  • SHA1

    27904b4cbb06a27120b68e0a7bdab69182521cb3

  • SHA256

    10ecd1dd4d07b21b320baa54f963868f7d73a8ff05e87311e6d62f1bc30a7877

  • SHA512

    29ed0085ea5decc29aeb3a13ca5607c56030628ba2141bd0ddf431e63a17cb6e800bf930d54792450b9c4cde7601ec17ddcd9b1261d4fd17872c466eb143c9a6

  • SSDEEP

    24576:6zfGFe9iCyU2iK8qwwgv54mbh4RezQxX+rYYhFNXi4chek:LsyUFK8qwPWmF4RezQp+rHhFIV

Malware Config

Extracted

Family

spynote

C2

127.0.0.1:4444

Targets

    • Target

      ready.apk

    • Size

      6.2MB

    • MD5

      15e8d18bfe1409173af0a38fce654109

    • SHA1

      27904b4cbb06a27120b68e0a7bdab69182521cb3

    • SHA256

      10ecd1dd4d07b21b320baa54f963868f7d73a8ff05e87311e6d62f1bc30a7877

    • SHA512

      29ed0085ea5decc29aeb3a13ca5607c56030628ba2141bd0ddf431e63a17cb6e800bf930d54792450b9c4cde7601ec17ddcd9b1261d4fd17872c466eb143c9a6

    • SSDEEP

      24576:6zfGFe9iCyU2iK8qwwgv54mbh4RezQxX+rYYhFNXi4chek:LsyUFK8qwPWmF4RezQp+rHhFIV

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks