lightspy | 4887389ffaf4257b37408eac9f1740eabe805f830009cf58185757372f903667

General

Target
4887389ffaf4257b37408eac9f1740eabe805f830009cf58185757372f903667
Size 2.6MB
Sample260923-nerl1ssdph
SHA256 4887389ffaf4257b37408eac9f1740eabe805f830009cf58185757372f903667
MD5 ff0f66b7089e06702ffaae6025b227f0
SHA1 a24b41da9d48353711e7ad02ddb93ec2aae19cfa
SHA512 4478f6dcc46a660583808af368fe7f16073f4bb5c4b5eec8675c0402bfd01d5f22f5ff070acb0eddf7ad74a0442b43c979dddacfcb815c56de6d102d26e5277d
SSDEEP 24576:+++cs7Sg4xwXP0WUFRElsplOPSIqCevF8QwJEOoAMo24GEIAs6Wlt/y1A:y7p8r/OPRyapMDPEI8WltyG
TLSH
T135C58D019E0C1A23E7C6F2BD9F044B98B12FFA544660C29B7C62A19DDCD5B8178777B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: LightSpy
LightSpy is a modular spyware framework first seen in 2020 and linked to APT41. Alongside iOS and Android implants, it ships Windows and macOS loaders that pull plugins from a C2 manifest.
trojan stealer backdoor loader lightspy

Detects LightSpy core iOS implant 1 IoCs

stealer apt apt41

resource	yara_rule
sample	family_lightspy_ios

SHA256 4887389ffaf4257b37408eac9f1740eabe805f830009cf58185757372f903667
MD5 ff0f66b7089e06702ffaae6025b227f0
SHA1 a24b41da9d48353711e7ad02ddb93ec2aae19cfa
SHA512 4478f6dcc46a660583808af368fe7f16073f4bb5c4b5eec8675c0402bfd01d5f22f5ff070acb0eddf7ad74a0442b43c979dddacfcb815c56de6d102d26e5277d
SSDEEP 24576:+++cs7Sg4xwXP0WUFRElsplOPSIqCevF8QwJEOoAMo24GEIAs6Wlt/y1A:y7p8r/OPRyapMDPEI8WltyG
TLSH
T135C58D019E0C1A23E7C6F2BD9F044B98B12FFA544660C29B7C62A19DDCD5B8178777B2
MD5 SHA1 SHA512 SSDEEP TLSH

macos arch:arm64