General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    250329-lvxrvssmt2

  • MD5

    2f27836441bbd0809e88093b21d5c8f4

  • SHA1

    6b0503dfc6b9bd285068e22060ac5e1a56ebf80f

  • SHA256

    415e471607a6a80cb2fa57709ad1e3dccceda6fe07bfd6f785329f5cbe70ac31

  • SHA512

    7a168a513e437b7e6fc6a6743c4af3697aead3b88dfadd5e6e91ea6ca5f07a71dc532dd0e307ddfd08a612806b3a3a92f0f9211349d758aa5cc8bb3b631d89a8

  • SSDEEP

    12288:0+kIwjba1a8LVeVZhijc0y5WmpYshXZPbGwidNpgqx:0+Oa1aKeVWjc0y5WmD9idNpZ

Malware Config

Extracted

Family

spynote

C2

193.161.193.99:1194

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      2f27836441bbd0809e88093b21d5c8f4

    • SHA1

      6b0503dfc6b9bd285068e22060ac5e1a56ebf80f

    • SHA256

      415e471607a6a80cb2fa57709ad1e3dccceda6fe07bfd6f785329f5cbe70ac31

    • SHA512

      7a168a513e437b7e6fc6a6743c4af3697aead3b88dfadd5e6e91ea6ca5f07a71dc532dd0e307ddfd08a612806b3a3a92f0f9211349d758aa5cc8bb3b631d89a8

    • SSDEEP

      12288:0+kIwjba1a8LVeVZhijc0y5WmpYshXZPbGwidNpgqx:0+Oa1aKeVWjc0y5WmD9idNpZ

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks