General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    250327-w2ws9aykv3

  • MD5

    1c6c85f1075548c79ff57d2e15c5e8fc

  • SHA1

    179467a2dde700f402fa4828290838685f46810e

  • SHA256

    402bb8c7868a0aedd6ba5cad412d11191a214b731fedc5da22a16e2bd738e1a2

  • SHA512

    4d9f0acb6c4c7031b6aa751f5e528285696367f852b06660ac19fab58e6851c91c615f813415377e3a49ca417d5495a873e2d30fb13e172cb08cf69f369e81c9

  • SSDEEP

    12288:nywaea1a8Lzezj6feUPf5WmpYshXZPbGwidNpgwto:yca1amezUeUPf5WmD9idNpA

Malware Config

Extracted

Family

spynote

C2

Hikitariko-60039.portmap.host:60039

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      1c6c85f1075548c79ff57d2e15c5e8fc

    • SHA1

      179467a2dde700f402fa4828290838685f46810e

    • SHA256

      402bb8c7868a0aedd6ba5cad412d11191a214b731fedc5da22a16e2bd738e1a2

    • SHA512

      4d9f0acb6c4c7031b6aa751f5e528285696367f852b06660ac19fab58e6851c91c615f813415377e3a49ca417d5495a873e2d30fb13e172cb08cf69f369e81c9

    • SSDEEP

      12288:nywaea1a8Lzezj6feUPf5WmpYshXZPbGwidNpgwto:yca1amezUeUPf5WmD9idNpA

    • Removes its main activity from the application launcher

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks