General
-
Target
ECU911.apk
-
Size
8.6MB
-
Sample
240703-ae19kaxbke
-
MD5
ef38a044d8a99bc61f156c7aafdd2c1e
-
SHA1
735f256de01f50fd68f2789929b8fe2cea43f16e
-
SHA256
d2456dc268ba784839ab58049ee28b96b961bbfd64b7c830b5d5d3a4ba364ed3
-
SHA512
adb3f8ec1ffaa1712a605d7685a30b19f3a757a2e3f4223a4ef32bd058417878bc83bd70a61276dc86b32a97e94a6efee1d22be02cc622639afded14341d7601
-
SSDEEP
196608:IYiSbH429GrSCGX2NDziYKYQLVQ0VQqVQQVQWVQ+i:IYJP9G22ND+YMLi0iqiQiWiZ
Behavioral task
behavioral1
Sample
ECU911.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
ECU911.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
ECU911.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
rafelrat
https://0ffs3c.com/qm/commands.php
Targets
-
-
Target
ECU911.apk
-
Size
8.6MB
-
MD5
ef38a044d8a99bc61f156c7aafdd2c1e
-
SHA1
735f256de01f50fd68f2789929b8fe2cea43f16e
-
SHA256
d2456dc268ba784839ab58049ee28b96b961bbfd64b7c830b5d5d3a4ba364ed3
-
SHA512
adb3f8ec1ffaa1712a605d7685a30b19f3a757a2e3f4223a4ef32bd058417878bc83bd70a61276dc86b32a97e94a6efee1d22be02cc622639afded14341d7601
-
SSDEEP
196608:IYiSbH429GrSCGX2NDziYKYQLVQ0VQqVQQVQWVQ+i:IYJP9G22ND+YMLi0iqiQiWiZ
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Legitimate hosting services abused for malware hosting/C2
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-