Resubmissions

01-09-2023 14:11

230901-rhnajsfd44 10

01-09-2023 13:44

230901-q1wh7sfc72 10

General

  • Target

    njRAT Lime Edition 0.8.0.apk

  • Size

    38KB

  • Sample

    230901-rhnajsfd44

  • MD5

    1e418a62ec9e744f13ecdb6b476317e2

  • SHA1

    10e7ad4d7ba1fa6785c481428e33d9cbc8e9381e

  • SHA256

    e408bb099256fd7a9ef1eed492b4eae2ada326a5a604b81894aa4cab76d191bc

  • SHA512

    f29e4555911007e3ce5371b65942d0bd1a1eb2d61f6dd12a30705bc98f3e6fd62726e4e9d75dacf68f4cb7027c276b0790e5662bb46ad83dc168bd1f097abab9

  • SSDEEP

    768:EqBgi6rnRd3NF30C38lHw05BPWYFcfuYDO7cyFiw84uullnf:EqBgvn73NFdmx/PRbYCUw84uylf

Malware Config

Extracted

Family

spymax

C2

5.tcp.eu.ngrok.io:10227

Targets

    • Target

      njRAT Lime Edition 0.8.0.apk

    • Size

      38KB

    • MD5

      1e418a62ec9e744f13ecdb6b476317e2

    • SHA1

      10e7ad4d7ba1fa6785c481428e33d9cbc8e9381e

    • SHA256

      e408bb099256fd7a9ef1eed492b4eae2ada326a5a604b81894aa4cab76d191bc

    • SHA512

      f29e4555911007e3ce5371b65942d0bd1a1eb2d61f6dd12a30705bc98f3e6fd62726e4e9d75dacf68f4cb7027c276b0790e5662bb46ad83dc168bd1f097abab9

    • SSDEEP

      768:EqBgi6rnRd3NF30C38lHw05BPWYFcfuYDO7cyFiw84uullnf:EqBgvn73NFdmx/PRbYCUw84uylf

    Score
    8/10
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Legitimate hosting services abused for malware hosting/C2

    • Makes a phone call.

MITRE ATT&CK Enterprise v15

Tasks