General
- Target ECU911.apk
- Size 8.6MB
- Sample240703-ae19kaxbke
- SHA256 d2456dc268ba784839ab58049ee28b96b961bbfd64b7c830b5d5d3a4ba364ed3
- MD5 ef38a044d8a99bc61f156c7aafdd2c1e
- SHA1 735f256de01f50fd68f2789929b8fe2cea43f16e
- SHA512 adb3f8ec1ffaa1712a605d7685a30b19f3a757a2e3f4223a4ef32bd058417878bc83bd70a61276dc86b32a97e94a6efee1d22be02cc622639afded14341d7601
- SSDEEP 196608:IYiSbH429GrSCGX2NDziYKYQLVQ0VQqVQQVQWVQ+i:IYJP9G22ND+YMLi0iqiQiWiZ
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
ECU911.apk
Resource
android-x86-arm-20240624-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ECU911.apk
Resource
android-x64-20240624-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
ECU911.apk
Resource
android-x64-arm64-20240624-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
rafelrat
C2
-
https://0ffs3c.com/qm/commands.php
Targets
-
- Target ECU911.apk
- Size 8.6MB
- SHA256 d2456dc268ba784839ab58049ee28b96b961bbfd64b7c830b5d5d3a4ba364ed3
- MD5 ef38a044d8a99bc61f156c7aafdd2c1e
- SHA1 735f256de01f50fd68f2789929b8fe2cea43f16e
- SHA512 adb3f8ec1ffaa1712a605d7685a30b19f3a757a2e3f4223a4ef32bd058417878bc83bd70a61276dc86b32a97e94a6efee1d22be02cc622639afded14341d7601
- SSDEEP 196608:IYiSbH429GrSCGX2NDziYKYQLVQ0VQqVQQVQWVQ+i:IYJP9G22ND+YMLi0iqiQiWiZ
- MD5 SHA1 SHA512 SSDEEP
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Legitimate hosting services abused for malware hosting/C2
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Requests accessing notifications (often used to intercept notifications before users become aware).