General

  • Target

    client.apk

  • Size

    760KB

  • Sample

    250330-mmkyrsyqy5

  • MD5

    79eab0beb9194682c9a14055d247666a

  • SHA1

    535e3a0d6d82b708ca21b32aa49e1b3d15279482

  • SHA256

    aca15ba9f21811bc3dde0f4e291e843267af4cd2611240ced2349f3a9b26e2e0

  • SHA512

    d07398ced17b11c2357008c8b483fa0b8e82002bd6065a9fc56288b8bfa61ea5d52d453d2b61621403f21019b059210767b42d937ff0a4506b0f149cac18e9b5

  • SSDEEP

    12288:c6kIwACa1a8LVe2/yMX+U/5WmpYshXZPbGwidNpgbZ:c6wa1aKe2/X+U/5WmD9idNpu

Malware Config

Extracted

Family

spynote

C2

193.161.193.99:1194

Targets

    • Target

      client.apk

    • Size

      760KB

    • MD5

      79eab0beb9194682c9a14055d247666a

    • SHA1

      535e3a0d6d82b708ca21b32aa49e1b3d15279482

    • SHA256

      aca15ba9f21811bc3dde0f4e291e843267af4cd2611240ced2349f3a9b26e2e0

    • SHA512

      d07398ced17b11c2357008c8b483fa0b8e82002bd6065a9fc56288b8bfa61ea5d52d453d2b61621403f21019b059210767b42d937ff0a4506b0f149cac18e9b5

    • SSDEEP

      12288:c6kIwACa1a8LVe2/yMX+U/5WmpYshXZPbGwidNpgbZ:c6wa1aKe2/X+U/5WmD9idNpu

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks