ec2654fcdaa602671c65fcd7df97643ddc73732e6291b08c5d2db03f667d6a9e

General

Target
e640eb702de37deb80c0a763eb67dea6.apk
Size 254KB
Sample240913-rn4jqatgra
SHA256 ec2654fcdaa602671c65fcd7df97643ddc73732e6291b08c5d2db03f667d6a9e
MD5 e640eb702de37deb80c0a763eb67dea6
SHA1 3e58d4ecce983b4489d5f2f73fbb536283f707f6
SHA512 a9fd31a8b39c845f8ffba5c882f626ac805df3675f75c9a03dfce498b9c07e695858eea75c096d5d2c838ec1fa2219d5fc43d786028bfc35ae3c23e171f04f6c
SSDEEP 6144:Hyr+4R4H6/f5QEgmz0GxRYuQUt9jsJ1zgbyN4V9itG:SFRuqf5/gmzRzMAQzgbU46G
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.droidjack.server

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.droidjack.server

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.droidjack.server

net.droidjack.server
1⤵
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4959

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 4da0f7c511a540be366bd92014b6279194cf5da3c47ddb8acb48526f1ad967ab
MD5 ab9b76032f3671e636504f620ed4d205
SHA1 21e1e3ef5f95af48acdd224ef1f40ff12467521d
SHA512 9e133dfb122855076eec7967f0e73fef6f8cdd655b32f9ee5d8cc7de1114212d10764839359b38b63e73772517910662109d87336a8507a99ca1085758841725
SSDEEP 6:l9bNFlqals1XMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK0DqiOw:TLpEXMAIXINJIWfRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 33842533915a2fde7e8b4e6e9739a21e5cec034b9957206471a6ba3e29bfb726
MD5 ba4ce7d301e236d7d2cce120476dda47
SHA1 92d1ca2724f9e9b56d0e307f48389e0b7b3329b1
SHA512 56bb1af96f619dbc83f0eea35d5be487d0f3f277f9b8c250258b020a00ddaa82b59064d1526f2691e22891a62a1b88da08d7149ea7a17efd549f0026066738e2
SSDEEP 6:l9bNFluls1ENMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/jqwllkixLo:TL8EENMAIXINJIWfRmBEyPbP/f0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 b63f0e7320d81ea5efdc591410a16c9bfab454987161225b0d7430653bd12faf
MD5 905dfa1ddfcdf365a4e1683c582ea50b
SHA1 bf398d31d5305b04074108816c7090e6813dc83c
SHA512 0bcbfd4f0a11983344966bc0a2f7e855dc28c6e746503a6196c9677bf953ebf8734d9a646241abc800d449b6e66da1f61f187cd5c9fcea05d6650ba730e096ff
SSDEEP 6:l9bNFl4/Sls1OqMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/Q5+uhpixLo:TLWuEOqMAIXINJIWfRmBEyPbP/Q5x
MD5 SHA1 SHA512 SSDEEP

Submit Download