3b9456aefd36eea636269c2b671535680d35b403872ea887ac763fe0933e86f1

General

Target

rtk_app.apk
Size

2.0MB
MD5

e8940b2330477cdf8531f5a112f9ac13
SHA1

4260129523ef4795d0127ceaf4708ab7505cfd14
SHA256

818ddda8ce0047af0e936b44f538d8c781f8f9fb0667ddbc9439249ce04189d6
SHA512

058262a504d5198703d5883d07380368a968150fdc39156b7ef6539f98a9c85d66a75deda20f266fee7844640f7fc94edf21840e20894ef495d8bedc2e10fdd4
SSDEEP

24576:61r0JN42Q+j4EsmOoVAOdzBKdXVlczfk7XFT4r0VbMXlp2b0uz90mclt5v5V4:5L/jslO4XVlvXcGb0+0HlzvM

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rtk.app

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rtk.app

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.rtk.app
Framework service call	android.app.IActivityManager.registerReceiver	com.rtk.app:pushservice

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.rtk.app:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rtk.app
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rtk.app:pushservice

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.rtk.app
1⤵
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4282

com.rtk.app:pushservice
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4377

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rtk.app/databases/xUtils.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.rtk.app/databases/xUtils.db-journal

Filesize
512B

MD5
7d036b2ac9084088d8eff89ef79c4ccf

SHA1
06b1e5b833becf07570fa5449a1ad2c04ada3c12

SHA256
afda3b7d943fa0aebb0dd796fa3ea91c59ce7edda14c24a4eea46e61025233a0

SHA512
30ebf6f4485698b5bf312c3f54a1360e91ae82e416e1ca3994fcde6055ef40cb62ddb7a369761392a3dff4e5817d0e03bf60fbe9f595af9cecafe229353f64fc

Download Submit
/data/data/com.rtk.app/databases/xUtils.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.rtk.app/databases/xUtils.db-wal

Filesize
84KB

MD5
24ed52f6566ae4a7eb78d16c25bee144

SHA1
81fadbe49886febb6f3e298fbdc192d4322e75a8

SHA256
a68961f51aa3712e7b86b272a016c5aac2dcef76c5ddf6766702d65a221bac32

SHA512
3ab93c4b275a858854466b4a8b5a20995b8991adcaa74407ef10551e7a60efd086e3e21a0d1fd1e9003b5d1ef86c54024965fc63c171019d0968fdec0134aec1

Download Submit
/data/data/com.rtk.app/files/.um/um_cache_1715839617986.env

Filesize
596B

MD5
40f75003d665252db5f17675d4f0e69c

SHA1
524fab0c520854bbdb19f0da55fa6626b226e688

SHA256
c6183c2df826e92b9b4a172c3d8fd4bf36b0e8e4adf300c5031aaae7d69b9d8a

SHA512
08e7907fae02e94fab7a04f552a5da87c1776f273b3a0a9da78662affc15e39b3f4c759271780dd98f48fa1e9ad8c89df954dd8925d09cf8a00b86cbb3a927fd

Download Submit
/data/data/com.rtk.app/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
b51e6cf92c70305578f6993beb7e876e

SHA1
e5303526bfbfe352d0c08874ff8cc66dd107e893

SHA256
a1d25cc25b3a95bdb995d4fe98dc6b11b9a7fac72e89f491594d6f70267db7f4

SHA512
fcdf4f9c9ccbf45f88e72b73716f66c006889d96cbbd498bcf73d1b4cb50bdf6a084f118d93b87a9479639f78278d8c273ff70d93997f95e304bb37f825f7189

Download Submit
/data/data/com.rtk.app/files/umeng_it.cache

Filesize
310B

MD5
046d5ed1447f0401d8578b65a0aa44c2

SHA1
d630f34082d8104f1272be63ebdc58395600ec54

SHA256
8fb7064f15d8fd0c4a6c0626a2ec46f4e487fc4f15849c7c97073502f5ac6a92

SHA512
09fbd6821163be13a49fb8cd06018fa0f50f55f07f4a1d49d2d00113a874f049002d8a0f735e5e6c4ac3abd2ea8a2ccc74dc593f5e821382a4cc358b7a452779

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads