Analysis
-
max time kernel
3751892s -
max time network
144s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system -
submitted
26-12-2023 14:07
Behavioral task
behavioral1
Sample
7462d3be5f649b52794ca5a1f1d201f1.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
7462d3be5f649b52794ca5a1f1d201f1.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
7462d3be5f649b52794ca5a1f1d201f1.apk
Resource
android-x64-arm64-20231215-en
General
-
Target
7462d3be5f649b52794ca5a1f1d201f1.apk
-
Size
4.7MB
-
MD5
7462d3be5f649b52794ca5a1f1d201f1
-
SHA1
2120f85722f2ad7ea1bec4d779ca738de28af9c6
-
SHA256
8fff451a8088ec7b89800fc743d43034a6531304429309beb073f888813ee16f
-
SHA512
77bdfdcd7db1617f94f1cfa041c895a19e1a4683b14252c2b4c22a60b87009a6aaf3c94e52f32f68d684c7b9608a4952418b14ce9b2b94db5a8e4d2e7e565f9e
-
SSDEEP
98304:DPDrwLnOoQqcwP91K8CTn2cil3MhlkGKfSJsg5CDX3po4dN4feL8I:fr6OoQ7c91Fw6lcbhJh5enpo4dN4feF
Malware Config
Signatures
-
888RAT
888RAT is an Android remote administration tool.
-
Processes:
com.example.dat.a8andoserverxpid process 4243 com.example.dat.a8andoserverx -
Acquires the wake lock 1 IoCs
Processes:
com.example.dat.a8andoserverxdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.example.dat.a8andoserverx -
Requests dangerous framework permissions 3 IoCs
Processes:
description ioc Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/storage/emulated/0/.app.apkFilesize
2.6MB
MD5c622c385ffb4599a816b6f590090d6cf
SHA109a12746b87bc3c0505866eaa8c53a67cd466dcb
SHA25696ecf26ed2024d99c916c22c6cb83fe42b3f60b8389c8966b773a1aef787c552
SHA5126760cf8a7faee06b5dd7d3a469208d23566bf135477406fa4ef371ce53eb82a9611553810f3a5efad63f7ea9175e2fa7f0233344f6802956fa4e1c7c50c8ed1c