21387422589551d9d521eb3362eb6194f27324912d1a39e8d0fe85785fcd8278

Analysis

max time kernel
149s
max time network
158s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
27-09-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AndroidRat.apk
Size

5.5MB
MD5

51e26f39c79f845548f1e75f74c7c517
SHA1

3baa6b8a7eaab4204865d4177a8a65cc0c39ef70
SHA256

21387422589551d9d521eb3362eb6194f27324912d1a39e8d0fe85785fcd8278
SHA512

1ee9c4a88aade68c648778c0be47902dda46c14b22a800ae65738284c75d212db78b8e6121b237089418856b83e767cdd14497af2204cb9d2a0efc66f64e05ff
SSDEEP

98304:NwubXW62AALy6GqYZpcQb788aGg82Qr9pzbuV7zphCIJaL31C8UofrFF3NPMP:NrXZJ6nicQHNaf8/IXrJaD1T3VMP

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	sigma.male
/system/xbin/su	sigma.male
/data/local/xbin/su	sigma.male
/data/local/bin/su	sigma.male
/system/sd/xbin/su	sigma.male
/data/local/su	sigma.male
/sbin/su	sigma.male
/system/bin/su	sigma.male
/system/bin/failsafe/su	sigma.male

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	sigma.male

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	sigma.male

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	sigma.male

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	sigma.male

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	sigma.male

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	sigma.male

sigma.male
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4972

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Android/data/sigma.male/files/panel.txt

Filesize
19B

MD5
6e0075dcc0b7ac222bea767743b61a33

SHA1
44b3eaebc17568ca6e120747fef61521137068d9

SHA256
d0d1b610858419980e61586967769ed1bf001756aacbd5e00518b3b0eb83a402

SHA512
9950d09e464f74889ae85d70e72e57197b8a2713518bb7901b2c7b6e1ae51dc7e53547b2865f0226bfcc3bd5ea530453298512f8ecbc7b790da3339b5e05cf42

Download Submit
/storage/emulated/0/Android/data/sigma.male/files/uid.txt

Filesize
8B

MD5
10c085d70ca04160e193d3d52e123b38

SHA1
b5e738f5dcdd0480a84c929a11f682af38fe6f5d

SHA256
3e80301d3447d1089ea37efc9274e496fd3bf1abf447c7b555fda13aaf9c3c7e

SHA512
1b33d7593f7dce59dee87e1c58c6f1265ce86c74468fd5b6dc03e8c472f9aedd433bbf8a316fc7bed8851ee26e4254ce33c2f2cabbf1403df4d0a2874aeaca1a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads