888rat

General

Target

23d23ede447193122acb545e6cff008d385b13d814a36c678db965d4e053a87a
Size

3.3MB
Sample

240913-xleepssfnm
MD5

c0dc87eb093913aac099e6e52ea810df
SHA1

a70863d6fb7564e81d4867165e9381d9cd2d86a8
SHA256

23d23ede447193122acb545e6cff008d385b13d814a36c678db965d4e053a87a
SHA512

2674afbad0809e95862257d382e8dbeab14f0af4b2757fc0eab422a6bd514c00f758b7455ddcdfcc643e18420b1505a386ced061f217150e29a7cfd52ddf073e
SSDEEP

98304:Z3YTPlToffum+rspiiawHOpMC4oM+vJoeO:Z3YTRsoUiiVHOpMrowB

Score

10^/10

Malware Config

Targets

- Target
  
  23d23ede447193122acb545e6cff008d385b13d814a36c678db965d4e053a87a
- Size
  
  3.3MB
- MD5
  
  c0dc87eb093913aac099e6e52ea810df
- SHA1
  
  a70863d6fb7564e81d4867165e9381d9cd2d86a8
- SHA256
  
  23d23ede447193122acb545e6cff008d385b13d814a36c678db965d4e053a87a
- SHA512
  
  2674afbad0809e95862257d382e8dbeab14f0af4b2757fc0eab422a6bd514c00f758b7455ddcdfcc643e18420b1505a386ced061f217150e29a7cfd52ddf073e
- SSDEEP
  
  98304:Z3YTPlToffum+rspiiawHOpMC4oM+vJoeO:Z3YTRsoUiiVHOpMrowB
Score

10^/10

888rat evasion infostealer persistence rat stealth trojan
- 888RAT
  888RAT is an Android remote administration tool.
  trojan infostealer rat 888rat
- Removes its main activity from the application launcher
  stealth trojan evasion
- Acquires the wake lock
- Declares services with permission to bind to the system
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests dangerous framework permissions
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Removes its main activity from the application launcher

Acquires the wake lock

Declares services with permission to bind to the system

Makes use of the framework's foreground persistence service

Requests dangerous framework permissions

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3