888rat | sep_tiktokSpyware[.]zip

General

Target

sep_tiktokSpyware.zip
Size

1.4MB
MD5

17a38d2889794604c8183c089b9cc3a8
SHA1

9d94ab5cd091cba40d6f5973894975bfb187b2a1
SHA256

fee6f339c94ca51f3a45ff5dd820b47909790eb1eb986c17ce9edaa11901c1a9
SHA512

87c0147e255f6eaa6b1b5c71be73fe152e4d57b3c86c3d625a7390b332ae7e6533a337cd38fd56bbfb552e5783b3b3b973771ee0b962b96cfb08befef2c80e8a
SSDEEP

24576:D+GeBkGFAlp1jKfdmQgcPjjEJaKwMbSWVnVKAmkIjNzTmzX7sAW43/BigHmwfTgb:UWlnijfEs/MWWfKNkIjNWnsI3/Bb7ru

Score

10^/10

888rat

Android 888 RAT payload 1 IoCs

resource	yara_rule
static1/unpack001/9fed52ee7312e217bd10d6a156c8b988.apk	family_888rat

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA