888rat | 8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15 | Triage

Sharing

General

Target

8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15
Size

2.0MB
Sample

240917-cm2leazcnb
MD5

a3ff7ca693095014914f3ae37f05ac28
SHA1

df519db5d0441db91881fc701faff240637ed6c5
SHA256

8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15
SHA512

ee01d2452d4741f2813b244e27cd8c94d17e9d5a9105694725556cd0c26ca2ffa10f8f087cbf9aded4427d738b8ff8fdb8c23b5f507b7d16ecf712ab2410d6e3
SSDEEP

49152:XrDrfuUFQWjF6ICtCbcj4ZtRxBnH4ZFm7Tpl0:XrDrHQUF6IPbccnRxN4ZFg0

Score

10^/10

888rat android discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Targets

- Target
  
  8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15
- Size
  
  2.0MB
- MD5
  
  a3ff7ca693095014914f3ae37f05ac28
- SHA1
  
  df519db5d0441db91881fc701faff240637ed6c5
- SHA256
  
  8651b7d7bee00f17fc9c6e0e65563c9b491e81edbde8c479bde6ec1ddc960d15
- SHA512
  
  ee01d2452d4741f2813b244e27cd8c94d17e9d5a9105694725556cd0c26ca2ffa10f8f087cbf9aded4427d738b8ff8fdb8c23b5f507b7d16ecf712ab2410d6e3
- SSDEEP
  
  49152:XrDrfuUFQWjF6ICtCbcj4ZtRxBnH4ZFm7Tpl0:XrDrHQUF6IPbccnRxN4ZFg0
Score

8^/10

discovery evasion impact persistence privilege_escalation stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
  privilege_escalation impact
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Foreground Persistence

Hide Artifacts

Suppress Application Icon

User Evasion

Credential Access

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

Tasks

static1

behavioral1

discoveryevasionimpactpersistenceprivilege_escalationstealthtrojan

behavioral2

discoveryevasionpersistence

behavioral3

discoveryevasionimpactpersistenceprivilege_escalation