General

  • Target

    .apk

  • Size

    760KB

  • Sample

    250219-w9gdjayj18

  • MD5

    5e7820fd6a577287db7515d9611d08d6

  • SHA1

    bf1a54a80ccb6cb67978f7499f026deb0ff259e6

  • SHA256

    4df5da682060fc9df9af0120eaf4bf956ed634b6ec08e683e30f1d1409862ae3

  • SHA512

    29863e4db13aa31f4708ceb2e22a038f5a2203c6c1994f7f9d472be99893ce78bde58f1b2999a0944da69b2c506af659d8cf1233f13d0a763ec4d38cbd74fd46

  • SSDEEP

    12288:Su3/a1a8LreJ4w9SBMtO5WmpYshXZPbGwidNpguvh:SIa1a2eJ4jBMtO5WmD9idNpVZ

Malware Config

Extracted

Family

spynote

C2

83.38.24.1:1603

Targets

    • Target

      .apk

    • Size

      760KB

    • MD5

      5e7820fd6a577287db7515d9611d08d6

    • SHA1

      bf1a54a80ccb6cb67978f7499f026deb0ff259e6

    • SHA256

      4df5da682060fc9df9af0120eaf4bf956ed634b6ec08e683e30f1d1409862ae3

    • SHA512

      29863e4db13aa31f4708ceb2e22a038f5a2203c6c1994f7f9d472be99893ce78bde58f1b2999a0944da69b2c506af659d8cf1233f13d0a763ec4d38cbd74fd46

    • SSDEEP

      12288:Su3/a1a8LreJ4w9SBMtO5WmpYshXZPbGwidNpguvh:SIa1a2eJ4jBMtO5WmD9idNpVZ

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks