General

  • Target

    ready.apk

  • Size

    696KB

  • Sample

    250219-m5vwpazlen

  • MD5

    d9f290fb187ef934a1d537a8e4e23d4d

  • SHA1

    e8ecb29ca4c3fbcf2c422e38ca5f5f42acbd1267

  • SHA256

    ad7edea231a4c057df19d0b552f64437aab5476801bb8d91af1e5fc4b40ddf7d

  • SHA512

    42733f2dcb466b381223fee1dea794d2cc67a39ef4afb409d8f0fda8510a1f368e266ba075457306dfe069d799fda246fd09acb24a65fdf2ec9a063b924dfb0f

  • SSDEEP

    12288:9QmhJeRll5/MHgvhjiZQNT3+HamhQR5S6Vm+6usT3cgtN0Fd06Rq21YgKZtWDYPI:9QrRllK8+ZQNOhTy6HT3SFd0GNtxYQ

Malware Config

Extracted

Family

spynote

C2

morning-ultimately.gl.at.ply.gg:morning-ultimately.gl.at.ply.gg:morning-ultimately.gl.at.ply.gg:14531:14531:14531

Targets

    • Target

      ready.apk

    • Size

      696KB

    • MD5

      d9f290fb187ef934a1d537a8e4e23d4d

    • SHA1

      e8ecb29ca4c3fbcf2c422e38ca5f5f42acbd1267

    • SHA256

      ad7edea231a4c057df19d0b552f64437aab5476801bb8d91af1e5fc4b40ddf7d

    • SHA512

      42733f2dcb466b381223fee1dea794d2cc67a39ef4afb409d8f0fda8510a1f368e266ba075457306dfe069d799fda246fd09acb24a65fdf2ec9a063b924dfb0f

    • SSDEEP

      12288:9QmhJeRll5/MHgvhjiZQNT3+HamhQR5S6Vm+6usT3cgtN0Fd06Rq21YgKZtWDYPI:9QrRllK8+ZQNOhTy6HT3SFd0GNtxYQ

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests enabling of the accessibility settings.

MITRE ATT&CK Mobile v15

Tasks