d2509053b285c78296c6960e9b07da05713b96799c38cf9c4861ab1b4490ff11

General

Target
rtk_app.apk
Size 2.6MB
Sample240601-rb6tbaeb9w
SHA256 3a69b0a413ee44e8da2a558457f3b9df4d8e65368586cf9d2dc48df75be700d1
MD5 6c7958fa0aaab85d1301461def35d378
SHA1 1d98e95cbf378edbff4cc279640a622eeb0dc51a
SHA512 528073f2c0419b516e7ada1ec79c148328c5397c41c6f19389f22189279c0b50879d0c4c90a9330c2aa05e554dcf4792b9e3d4722ddf7c3cbdcd257494197732
SSDEEP 49152:wA1OFsf1w8ZLkmCWwB/ImagZ7xHC0vqz6DxJY0E9kh6RLddpt4KgQM:bOSw8mmCWwB/ImvHCWzYE6RG
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.rtk.app

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rtk.app

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rtk.app
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rtk.app:pushservice

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
24	alog.umeng.com

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rtk.app:pushservice

com.rtk.app
1⤵
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4540

com.rtk.app:pushservice
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4581

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

pushsdk.db-journal

Path /data/user/0/com.rtk.app/databases/pushsdk.db-journal
Size 8KB
SHA256 1b46c1dec05a49ce40cad73c552f34bf36a97ccc21d1021513f7cb049409f40e
MD5 5e274a11e0c870378fa59309bb1d7f99
SHA1 dbec8910ca982d95fb006b2db08d8de8cd0f9e03
SHA512 4e35992361258d6cb38d9c88f8f4bb1f81a00b933f649626759a7291da86e30d7dc29107a09166960a4eb8d71a306ba5b839bc2d7df470d2a189d6f88e54012d
SSDEEP 12:7+tx8Qw0RBB0Rx85WbfqLJdeWRmBEyPbQXz:7+txDB0zJqLJKGSQXz
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.rtk.app/databases/pushsdk.db-journal
Size 8KB
SHA256 5d76ed07f1b94fc4d2c7e5e8a85c15c549518d00dbd6b16bed046feab154c8bb
MD5 f5559a78316435ed5219ffcd1a9606e4
SHA1 7f07a8269599c3e76858973fc2aa4b3c79945909
SHA512 0111642031b5915a55ad5d195e5c7882b808d3368d1ee8f143fa5e9ae2c6e67b7d0b50d7b2d2fed9f63af902728dbe286b3e3712a1dc09bfabea5088b3f14c7f
SSDEEP 48:M8kaBAgW1yEjRqRT7/W0xopA/t379y/MSk:iaBARjR6P/W0+pYto/tk
MD5 SHA1 SHA512 SSDEEP

Submit Download

pushsdk.db-journal

Path /data/user/0/com.rtk.app/databases/pushsdk.db-journal
Size 8KB
SHA256 8ec232ab71f8c835134236b11e2582554731fbbc282dbe40cf5469e9981e888c
MD5 0b8624103b0d023e5fe6c3f47195c26a
SHA1 dc5fba20cfe9c0ef2e76e663207aa940584e6c21
SHA512 3998ad7c73906032643d1ea879289b865496589ada4be4422558b3972ac25f3b7df34012d689310a88f5843a3ebf3e3a790e7c6af41a6bde9bc62dcf90aab1c9
SSDEEP 24:7+tjUbCAC1g/WqLCTU7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSy:7MjkpWqEU7/W0xopA/t379y/MSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

xUtils.db

Path /data/user/0/com.rtk.app/databases/xUtils.db
Size 12KB
SHA256 49db099db058c0e220719e85f4c0b2f4ad1dcd739486f4c409f958484d1eeb01
MD5 f35607454204970202e130f2333a4315
SHA1 e8e7ccae13ced73f9fbd434f8d614f1abcc70c56
SHA512 8ab7a6da5f90469fe1e713a61576bcc8981b75b3eb31a22e32fd4635e3858760d4efb5c7295931f89f7e65b586b6e850499cd097ab8d84712787c3b39095e584
SSDEEP 6:GlTyTVxkYwWWwELVqb/kPlOERX4PBX4ogLugMBX4suuKTqiOw2:yTyTViiW1LDRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

xUtils.db-journal

Path /data/user/0/com.rtk.app/databases/xUtils.db-journal
Size 48KB
SHA256 ac4e1c5683e4159e17cc6a0fb6f8ff79b461beeaaf0f9c1ebfa01f7bbacd2785
MD5 95218dda1b6d57fe8e51de075c709f55
SHA1 e8ebcbfb7b949de76dad5f7d69bc401f3b36ff31
SHA512 21728bb9de4bdbf954658b657996709ed0ed07b39ff69a889e2a1ec22ae3a4ec9d87b4f8a41bd37ab91912ecb6270703d9f2cdd322ba279ce0e3020d4e9171f9
SSDEEP 24:TL7Z7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSFqU9KCAC1g/AQQeQ:TXZ7/W0xopA/t379y/MSAMKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

xUtils.db-journal

Path /data/user/0/com.rtk.app/databases/xUtils.db-journal
Size 8KB
SHA256 0f6de940acb094bd710c353a788d3250b8a15cda7c4f33a882ab7df62feaa6c5
MD5 ea27e068a6e00686631871decc80c8cc
SHA1 5ded131d9f14cfa8b445ad469c62e59538f4849b
SHA512 bc4edc2af3f409df36cb64763619b6c2045d3f70db500fb4e84d1f715c0d9368a3a1da5c206b4b072de30dd333abd7985d0072a216e72be4c85d5e459e5e2f99
SSDEEP 6:7+/l/YR13Xvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKzw:7+t/gfqLiuWdYRmBEyPb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

xUtils.db-journal

Path /data/user/0/com.rtk.app/databases/xUtils.db-journal
Size 8KB
SHA256 cc501fcabed5107a6a9e7a86784df23d5c66d534646b3b9ef2311df9d0097140
MD5 203c74fd997a3343f47ac3f5250104fd
SHA1 2613923edc7606a7ef0e5359572d3d4ccfd04b25
SHA512 0144197444225963de92b77a5d99117eee599819eef5158a1e4f76e9d840102c49227a835611f86d559b34d074f9545d6ab2220de0e18b930f80634f688d2c6d
SSDEEP 6:7+/l99Gn1jStng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKr4:7+tftnqLiuWdYRmBEyPbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

exchangeIdentity.json

Path /data/user/0/com.rtk.app/files/.umeng/exchangeIdentity.json
Size 4KB
SHA256 ac4fb1a04520e1659831cac1cd3fb5866f063ee7553f4d466f2a139d628f4674
MD5 f11df1da0d0dd9f7819ee6c467fb049f
SHA1 aaa042a9eb825a929dbb48f9456165b41c1c2620
SHA512 a23f60bc47dabb3e8fef459e8fceabd34323637b344672b7063b665136d01a0f45af639a5b764dc71d57baf3beba1efd8be5caf1c016ee85fd63c3f88fa63153
SSDEEP 24:7+tUbqLqG7s9QW0uUduRwCJAWfLq8w7qTQ3o0h7igzD1ZHtU/TVGSL:7MOqGG7/W0xopA/t379y/MSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads