General
- Target ready.apk
- Size 23.2MB
- Sample260722-m9zensea75
- SHA256 9759a9b596ce9bfe7350febd49e4da70ec7254136e9dbde46abdefd2e8fc7fd0
- MD5 673d807cee68a097512bb6c764a69145
- SHA1 4fa4bbbb9f9d2f1f0cb51b114447e98be9d52c79
- SHA512 b97d49d5f0971e59bd3ab2247a52bfc07e0eafa978e00f9639d226f770940d8fa02bebf8594f431585d240a7d17258eeb0dc1351edc5071da901faf76ecaa3e6
- SSDEEP 98304:dVqV3nRZYyaxR1f/cb3Pmz5zBpTVn0tB1:dIFEB1f1zF+P
- TLSH T13837F113FA05CAC3C46C93F5BA130FA92A6B1F09D5516EEB10193A9F3EB62D609D54CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
ready.apk
Resource
android-x64-arm64-20260325-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
spynote
C2
-
tcp.niceports.shop:21667:21667
Targets
-
- Target ready.apk
- Size 23.2MB
- SHA256 9759a9b596ce9bfe7350febd49e4da70ec7254136e9dbde46abdefd2e8fc7fd0
- MD5 673d807cee68a097512bb6c764a69145
- SHA1 4fa4bbbb9f9d2f1f0cb51b114447e98be9d52c79
- SHA512 b97d49d5f0971e59bd3ab2247a52bfc07e0eafa978e00f9639d226f770940d8fa02bebf8594f431585d240a7d17258eeb0dc1351edc5071da901faf76ecaa3e6
- SSDEEP 98304:dVqV3nRZYyaxR1f/cb3Pmz5zBpTVn0tB1:dIFEB1f1zF+P
- TLSH T13837F113FA05CAC3C46C93F5BA130FA92A6B1F09D5516EEB10193A9F3EB62D609D54CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Tries to add a device administrator.
MITRE ATT&CK Mobile v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1