888rat | sep_tiktokSpyware[.]zip

General

Target
sep_tiktokSpyware.zip
Size 1.4MB
Sample240814-2sl6cavdrr
SHA256 fee6f339c94ca51f3a45ff5dd820b47909790eb1eb986c17ce9edaa11901c1a9
MD5 17a38d2889794604c8183c089b9cc3a8
SHA1 9d94ab5cd091cba40d6f5973894975bfb187b2a1
SHA512 87c0147e255f6eaa6b1b5c71be73fe152e4d57b3c86c3d625a7390b332ae7e6533a337cd38fd56bbfb552e5783b3b3b973771ee0b962b96cfb08befef2c80e8a
SSDEEP 24576:D+GeBkGFAlp1jKfdmQgcPjjEJaKwMbSWVnVKAmkIjNzTmzX7sAW43/BigHmwfTgb:UWlnijfEs/MWWfKNkIjNWnsI3/Bb7ru
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

888rat

Android 888 RAT payload 1 IoCs

resource	yara_rule
static1/unpack001/9fed52ee7312e217bd10d6a156c8b988.apk	family_888rat

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA

SHA256 fee6f339c94ca51f3a45ff5dd820b47909790eb1eb986c17ce9edaa11901c1a9
MD5 17a38d2889794604c8183c089b9cc3a8
SHA1 9d94ab5cd091cba40d6f5973894975bfb187b2a1
SHA512 87c0147e255f6eaa6b1b5c71be73fe152e4d57b3c86c3d625a7390b332ae7e6533a337cd38fd56bbfb552e5783b3b3b973771ee0b962b96cfb08befef2c80e8a
SSDEEP 24576:D+GeBkGFAlp1jKfdmQgcPjjEJaKwMbSWVnVKAmkIjNzTmzX7sAW43/BigHmwfTgb:UWlnijfEs/MWWfKNkIjNWnsI3/Bb7ru
MD5 SHA1 SHA512 SSDEEP

Password

infected

SHA256 6ac2fadf96fb423f7c22521fcb106e44343d26c8d682e8b5a460cdf8388b2178
MD5 9fed52ee7312e217bd10d6a156c8b988
SHA1 3e23c0d93b51e06918c69b138ef5fbeb921c9f95
SHA512 dfd8dc7d623d2c142cbe11473324f34250115fb3c7e08a6b60f319ac9f419aa5301f3e042a525639398c54cfe3f1175426af09732cbb05932e4487baa91f5f4d
SSDEEP 24576:0ZCqpP9JH/VoVPvQrHs7zOSKHynup2usCAdYvgK5zT2y6HvCVMjny9L5hX/zqrI:0ZxxVopuHsOltFgg6abvX/zuI
MD5 SHA1 SHA512 SSDEEP

android

com.example.dat.a8andoserverx