General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    250329-lrbefs1sb1

  • MD5

    3b0e7b417e5700ede7bdb3d0f030ec42

  • SHA1

    23e06cf58d004121c0d0bb7886cc5cb97f266a64

  • SHA256

    3b1d128d9b5952c0ca73323b42e6ac51296ad3da5ce3722587662dd030c584bf

  • SHA512

    1caf1593efa24c8a77a7cb8f660f572e0cdd27a1311965c0029a31ab9df5a9d422786fc19bdff13547d6e6b8d50e422672d03363b9637e04b36cfc6be27b0155

  • SSDEEP

    12288:JjGFzCzPa1a8LzeuouYcewH5WmpYshXZPbGwidNpgp+q:JjFPa1ameuscewH5WmD9idNpc

Malware Config

Extracted

Family

spynote

C2

193.161.193.99:1194

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      3b0e7b417e5700ede7bdb3d0f030ec42

    • SHA1

      23e06cf58d004121c0d0bb7886cc5cb97f266a64

    • SHA256

      3b1d128d9b5952c0ca73323b42e6ac51296ad3da5ce3722587662dd030c584bf

    • SHA512

      1caf1593efa24c8a77a7cb8f660f572e0cdd27a1311965c0029a31ab9df5a9d422786fc19bdff13547d6e6b8d50e422672d03363b9637e04b36cfc6be27b0155

    • SSDEEP

      12288:JjGFzCzPa1a8LzeuouYcewH5WmpYshXZPbGwidNpgp+q:JjFPa1ameuscewH5WmD9idNpc

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks