General

  • Target

    s7b Soor.apk

  • Size

    692KB

  • Sample

    250217-sd9hna1ls3

  • MD5

    b26b0f59921391a35d2c6bf4bd72b260

  • SHA1

    03612b5413469743ee3314c1f4a4725e100c0014

  • SHA256

    ffc1f00d45921e2f3297a82c0bef32dd942048c88edd5c7c59ef828de0c7c035

  • SHA512

    c4ddb21f82c3b9652d71903b602efcd9a63ddc35645b456b5f94515640ea3c82049376cdf190ad397761c5806b3d37f751eb08d4f598c494582f9823b679c923

  • SSDEEP

    12288:P/rRav1K3NeWdK2lJNF6+iCqwSyTZwDb2usT3cgtN0FiE6Rq21Eg9dtWDHVJ:7MvE3EWd1lfSaGb2HT3SFiEGNZ0Hf

Malware Config

Extracted

Family

spynote

C2

3skr.uncofig.com:9999

Targets

    • Target

      s7b Soor.apk

    • Size

      692KB

    • MD5

      b26b0f59921391a35d2c6bf4bd72b260

    • SHA1

      03612b5413469743ee3314c1f4a4725e100c0014

    • SHA256

      ffc1f00d45921e2f3297a82c0bef32dd942048c88edd5c7c59ef828de0c7c035

    • SHA512

      c4ddb21f82c3b9652d71903b602efcd9a63ddc35645b456b5f94515640ea3c82049376cdf190ad397761c5806b3d37f751eb08d4f598c494582f9823b679c923

    • SSDEEP

      12288:P/rRav1K3NeWdK2lJNF6+iCqwSyTZwDb2usT3cgtN0FiE6Rq21Eg9dtWDHVJ:7MvE3EWd1lfSaGb2HT3SFiEGNZ0Hf

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

MITRE ATT&CK Mobile v15

Tasks