General

  • Target

    ECU911.apk

  • Size

    8.6MB

  • Sample

    240703-ae19kaxbke

  • MD5

    ef38a044d8a99bc61f156c7aafdd2c1e

  • SHA1

    735f256de01f50fd68f2789929b8fe2cea43f16e

  • SHA256

    d2456dc268ba784839ab58049ee28b96b961bbfd64b7c830b5d5d3a4ba364ed3

  • SHA512

    adb3f8ec1ffaa1712a605d7685a30b19f3a757a2e3f4223a4ef32bd058417878bc83bd70a61276dc86b32a97e94a6efee1d22be02cc622639afded14341d7601

  • SSDEEP

    196608:IYiSbH429GrSCGX2NDziYKYQLVQ0VQqVQQVQWVQ+i:IYJP9G22ND+YMLi0iqiQiWiZ

Malware Config

Extracted

Family

rafelrat

C2

https://0ffs3c.com/qm/commands.php

Targets

    • Target

      ECU911.apk

    • Size

      8.6MB

    • MD5

      ef38a044d8a99bc61f156c7aafdd2c1e

    • SHA1

      735f256de01f50fd68f2789929b8fe2cea43f16e

    • SHA256

      d2456dc268ba784839ab58049ee28b96b961bbfd64b7c830b5d5d3a4ba364ed3

    • SHA512

      adb3f8ec1ffaa1712a605d7685a30b19f3a757a2e3f4223a4ef32bd058417878bc83bd70a61276dc86b32a97e94a6efee1d22be02cc622639afded14341d7601

    • SSDEEP

      196608:IYiSbH429GrSCGX2NDziYKYQLVQ0VQqVQQVQWVQ+i:IYJP9G22ND+YMLi0iqiQiWiZ

    • Checks if the Android device is rooted.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Legitimate hosting services abused for malware hosting/C2

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Requests accessing notifications (often used to intercept notifications before users become aware).

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks