General

  • Target

    client.apk

  • Size

    24.2MB

  • Sample

    240630-sbxfbazbqh

  • MD5

    2f9fc4d1f25cfe6c617f2e7c16ef2f21

  • SHA1

    7981b0b171434ad041811c26e33f89558508481c

  • SHA256

    2793ed12bc287eced62485f9d9ed08355177948b2662b9a9214dd194e22f0427

  • SHA512

    b312a5dc42c7f5b7c3c48c12f9df73c642dba1325a6fb95ac503a317f35649bddb668af7116b3e88d3140d6c5fa9b7c2ea5100bbc6633f0f0b22306a9fe9586f

  • SSDEEP

    393216:D9tGFggbUaOiIYdk08iCKyBBeu2Wvgwv71V0IBKKPZ9BaxG:D9hgYaOR0kMQBBr2AR71eIBKWZaxG

Malware Config

Extracted

Family

spynote

C2

java-mas.gl.at.ply.gg:23199

Targets

    • Target

      client.apk

    • Size

      24.2MB

    • MD5

      2f9fc4d1f25cfe6c617f2e7c16ef2f21

    • SHA1

      7981b0b171434ad041811c26e33f89558508481c

    • SHA256

      2793ed12bc287eced62485f9d9ed08355177948b2662b9a9214dd194e22f0427

    • SHA512

      b312a5dc42c7f5b7c3c48c12f9df73c642dba1325a6fb95ac503a317f35649bddb668af7116b3e88d3140d6c5fa9b7c2ea5100bbc6633f0f0b22306a9fe9586f

    • SSDEEP

      393216:D9tGFggbUaOiIYdk08iCKyBBeu2Wvgwv71V0IBKKPZ9BaxG:D9hgYaOR0kMQBBr2AR71eIBKWZaxG

    • Removes its main activity from the application launcher

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Matrix

Tasks