General
-
Target
AndroidRat.apk
-
Size
5.5MB
-
Sample
240927-s4k8razaqj
-
MD5
51e26f39c79f845548f1e75f74c7c517
-
SHA1
3baa6b8a7eaab4204865d4177a8a65cc0c39ef70
-
SHA256
21387422589551d9d521eb3362eb6194f27324912d1a39e8d0fe85785fcd8278
-
SHA512
1ee9c4a88aade68c648778c0be47902dda46c14b22a800ae65738284c75d212db78b8e6121b237089418856b83e767cdd14497af2204cb9d2a0efc66f64e05ff
-
SSDEEP
98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL31C8UofrFF3NPMP:NrXZJ6nicQHNaf8/IXrJaD1T3VMP
Behavioral task
behavioral1
Sample
AndroidRat.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
AndroidRat.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
AndroidRat.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
airavat
https://sigma-b2650-default-rtdb.firebaseio.com
Targets
-
-
Target
AndroidRat.apk
-
Size
5.5MB
-
MD5
51e26f39c79f845548f1e75f74c7c517
-
SHA1
3baa6b8a7eaab4204865d4177a8a65cc0c39ef70
-
SHA256
21387422589551d9d521eb3362eb6194f27324912d1a39e8d0fe85785fcd8278
-
SHA512
1ee9c4a88aade68c648778c0be47902dda46c14b22a800ae65738284c75d212db78b8e6121b237089418856b83e767cdd14497af2204cb9d2a0efc66f64e05ff
-
SSDEEP
98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL31C8UofrFF3NPMP:NrXZJ6nicQHNaf8/IXrJaD1T3VMP
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-
Requests enabling of the accessibility settings.
-