General

  • Target

    ready.apk

  • Size

    3.6MB

  • Sample

    250222-x31z2axrx9

  • MD5

    35698dc35d4803061c1c15e0501b2d56

  • SHA1

    58b4a71ac7977c30bf61b7d8148e38e8b0e77e8f

  • SHA256

    25a94c53622e7c8d21057b00d8e6161c86f0ba39fed646383687f33ab9ffec67

  • SHA512

    5ea11dc34d8cf9bf1f22a38812fd3035300204840869fe97c01594f17dba5671dff75ecfe23292af4e7704dc30aa36f22f0b2664adcc796b39ea3c05f2928e11

  • SSDEEP

    98304:hIsxzvNWcGeBShMtjnZW7yAm5amzHzBMTY0tZM:qsxDxbSWtjZWFGzuDO

Malware Config

Extracted

Family

spynote

C2

192.168.56.1:7771

Targets

    • Target

      ready.apk

    • Size

      3.6MB

    • MD5

      35698dc35d4803061c1c15e0501b2d56

    • SHA1

      58b4a71ac7977c30bf61b7d8148e38e8b0e77e8f

    • SHA256

      25a94c53622e7c8d21057b00d8e6161c86f0ba39fed646383687f33ab9ffec67

    • SHA512

      5ea11dc34d8cf9bf1f22a38812fd3035300204840869fe97c01594f17dba5671dff75ecfe23292af4e7704dc30aa36f22f0b2664adcc796b39ea3c05f2928e11

    • SSDEEP

      98304:hIsxzvNWcGeBShMtjnZW7yAm5amzHzBMTY0tZM:qsxDxbSWtjZWFGzuDO

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks