General

  • Target

    4b643a3b100ee620ca66ddde40c345f5b1bf4348c4788d18564ca9855b7d1c14.bin

  • Size

    760KB

  • Sample

    240701-1wz1yawdpm

  • MD5

    4df8ca1139488d3963cb8fd6b1251f70

  • SHA1

    b4ec39bd425612a3cfc530939c4189d0a46c8928

  • SHA256

    4b643a3b100ee620ca66ddde40c345f5b1bf4348c4788d18564ca9855b7d1c14

  • SHA512

    23086f85b73e1e0352c30f345b60e6522169a935712b6f5a2896b8d5703ca67551b3acfefa2e80349a11eb6aabeb24dfd5946daee9d8026766b49b0419a997cf

  • SSDEEP

    12288:r3ATta1a8LreSnIhsp195WmpYshXZPbGwidNpgI:roa1a2eS4sp195WmD9idNpT

Malware Config

Extracted

Family

spynote

C2

song-habitat.gl.at.ply.gg:53902

Targets

    • Target

      4b643a3b100ee620ca66ddde40c345f5b1bf4348c4788d18564ca9855b7d1c14.bin

    • Size

      760KB

    • MD5

      4df8ca1139488d3963cb8fd6b1251f70

    • SHA1

      b4ec39bd425612a3cfc530939c4189d0a46c8928

    • SHA256

      4b643a3b100ee620ca66ddde40c345f5b1bf4348c4788d18564ca9855b7d1c14

    • SHA512

      23086f85b73e1e0352c30f345b60e6522169a935712b6f5a2896b8d5703ca67551b3acfefa2e80349a11eb6aabeb24dfd5946daee9d8026766b49b0419a997cf

    • SSDEEP

      12288:r3ATta1a8LreSnIhsp195WmpYshXZPbGwidNpgI:roa1a2eS4sp195WmD9idNpT

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Requests enabling of the accessibility settings.

    • Tries to add a device administrator.

MITRE ATT&CK Matrix

Tasks