General

  • Target

    6ec70b55b73d7d5fa8ca5d2ba99a5fe3be3c8dcf333e8cf9d5c9862eb7278df9.bin

  • Size

    760KB

  • Sample

    240630-11axlsxarh

  • MD5

    d3eb6b8199a2a0f25dc4c6897e47c50f

  • SHA1

    3220a14620484b7fa39b108d9adaab94e11fcfe8

  • SHA256

    6ec70b55b73d7d5fa8ca5d2ba99a5fe3be3c8dcf333e8cf9d5c9862eb7278df9

  • SHA512

    ef1dd0ffd97ffd360407769aca43e03847d3509197227870a54a9870b32e9ababe9d7f7185b3b9f0f8e2f7e88b9e4156a3d59996351b11a6027aef6c0c555e95

  • SSDEEP

    12288:49JFCra1a8LreTxreR06E5WmpYshXZPbGwidNpgA:AJSa1a2eTQR06E5WmD9idNpT

Malware Config

Extracted

Family

spynote

C2

currently-judges.gl.at.ply.gg:33065

Targets

    • Target

      6ec70b55b73d7d5fa8ca5d2ba99a5fe3be3c8dcf333e8cf9d5c9862eb7278df9.bin

    • Size

      760KB

    • MD5

      d3eb6b8199a2a0f25dc4c6897e47c50f

    • SHA1

      3220a14620484b7fa39b108d9adaab94e11fcfe8

    • SHA256

      6ec70b55b73d7d5fa8ca5d2ba99a5fe3be3c8dcf333e8cf9d5c9862eb7278df9

    • SHA512

      ef1dd0ffd97ffd360407769aca43e03847d3509197227870a54a9870b32e9ababe9d7f7185b3b9f0f8e2f7e88b9e4156a3d59996351b11a6027aef6c0c555e95

    • SSDEEP

      12288:49JFCra1a8LreTxreR06E5WmpYshXZPbGwidNpgA:AJSa1a2eTQR06E5WmD9idNpT

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Matrix

Tasks