sandrorat | ec2654fcdaa602671c65fcd7df97643ddc73732e6291b08c5d2db03f667d6a9e

General

Target
e640eb702de37deb80c0a763eb67dea6
Size 254KB
Sample240913-rn4jqatgra
SHA256 ec2654fcdaa602671c65fcd7df97643ddc73732e6291b08c5d2db03f667d6a9e
MD5 e640eb702de37deb80c0a763eb67dea6
SHA1 3e58d4ecce983b4489d5f2f73fbb536283f707f6
SHA512 a9fd31a8b39c845f8ffba5c882f626ac805df3675f75c9a03dfce498b9c07e695858eea75c096d5d2c838ec1fa2219d5fc43d786028bfc35ae3c23e171f04f6c
SSDEEP 6144:Hyr+4R4H6/f5QEgmz0GxRYuQUt9jsJ1zgbyN4V9itG:SFRuqf5/gmzRzMAQzgbU46G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

sandrorat

C2

majdazar.ddns.net:1337

Targets

- Target
  e640eb702de37deb80c0a763eb67dea6
- Size 254KB
- SHA256 ec2654fcdaa602671c65fcd7df97643ddc73732e6291b08c5d2db03f667d6a9e
- MD5 e640eb702de37deb80c0a763eb67dea6
- SHA1 3e58d4ecce983b4489d5f2f73fbb536283f707f6
- SHA512 a9fd31a8b39c845f8ffba5c882f626ac805df3675f75c9a03dfce498b9c07e695858eea75c096d5d2c838ec1fa2219d5fc43d786028bfc35ae3c23e171f04f6c
- SSDEEP 6144:Hyr+4R4H6/f5QEgmz0GxRYuQUt9jsJ1zgbyN4V9itG:SFRuqf5/gmzRzMAQzgbU46G
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence
- Acquires the wake lock
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Acquires the wake lock

Queries information about active data network

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3