General

  • Target

    Zaduxx Fix.apk

  • Size

    10.6MB

  • Sample

    250330-qpefjs1rt7

  • MD5

    43659d20712e6be0cfaa790a320bc3d7

  • SHA1

    28df353db681193c0a686d6c07deb90063b472c0

  • SHA256

    1863ea5a1ecfeda55b4c36ea4c01090ac7eba9cd053765d69c0e4369a4279194

  • SHA512

    e7ee0cf92232606ed1ec25f5c80e945a00a0189a8fed543717909773d4a07147e940a9ebacac771b7073e89e369657df21386016154405021bd709a178ac7741

  • SSDEEP

    196608:pAXzQRbNezMp4rHZLBTicUYcdhcJ+ef8ocH21dBuDGQ43UrQLbKpRRL+TRf:pCzYR0Mp4rDT3UYcdht2lQyLbagf

Malware Config

Extracted

Family

spynote

C2

4.tcp.eu.ngrok.io:13556

Targets

    • Target

      Zaduxx Fix.apk

    • Size

      10.6MB

    • MD5

      43659d20712e6be0cfaa790a320bc3d7

    • SHA1

      28df353db681193c0a686d6c07deb90063b472c0

    • SHA256

      1863ea5a1ecfeda55b4c36ea4c01090ac7eba9cd053765d69c0e4369a4279194

    • SHA512

      e7ee0cf92232606ed1ec25f5c80e945a00a0189a8fed543717909773d4a07147e940a9ebacac771b7073e89e369657df21386016154405021bd709a178ac7741

    • SSDEEP

      196608:pAXzQRbNezMp4rHZLBTicUYcdhcJ+ef8ocH21dBuDGQ43UrQLbKpRRL+TRf:pCzYR0Mp4rDT3UYcdht2lQyLbagf

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Tries to add a device administrator.

MITRE ATT&CK Mobile v15

Tasks