androrat | d7c358fadad18ff30432f3840f58d471416a1ea4f47ac9f5b1c6e170e8a0e005 | Triage

Resubmissions

07/08/2024, 18:04

240807-wnsjnsvdrb 10

Sharing

General

Target

evil.apk
Size

2.2MB
Sample

240807-wnsjnsvdrb
MD5

2acbaece60958c4387ae33e58fd3dc6c
SHA1

9b027236b6a7bb3559da27caaa5e36f64d1b1928
SHA256

d7c358fadad18ff30432f3840f58d471416a1ea4f47ac9f5b1c6e170e8a0e005
SHA512

cce43b720951d0a105c44df819074d5669eb366164f582f699e41eb1afa309ab144f025f28cdf671d58f9fb38af6a435f05c1fa2c0f6f0112d108e9aec7a63d3
SSDEEP

49152:/gvYb7wVqDTrbHt0RI0FQBoEXw0DMw5B8WR87abKgLvxkiUCvB:DSqDDae0UBA0X8t38dvB

Score

10^/10

androrat android discovery evasion execution persistence stealth trojan

Malware Config

Extracted

Family

androrat

C2

192.169.x.x:8000

Targets

- Target
  
  evil.apk
- Size
  
  2.2MB
- MD5
  
  2acbaece60958c4387ae33e58fd3dc6c
- SHA1
  
  9b027236b6a7bb3559da27caaa5e36f64d1b1928
- SHA256
  
  d7c358fadad18ff30432f3840f58d471416a1ea4f47ac9f5b1c6e170e8a0e005
- SHA512
  
  cce43b720951d0a105c44df819074d5669eb366164f582f699e41eb1afa309ab144f025f28cdf671d58f9fb38af6a435f05c1fa2c0f6f0112d108e9aec7a63d3
- SSDEEP
  
  49152:/gvYb7wVqDTrbHt0RI0FQBoEXw0DMw5B8WR87abKgLvxkiUCvB:DSqDDae0UBA0X8t38dvB
Score

8^/10

discovery evasion execution persistence stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Queries information about active data network
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionexecutionpersistencestealthtrojan