50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a

Analysis

max time kernel
12s
max time network
148s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
06-11-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a.apk
Size

14.6MB
MD5

0ee0fd1549279eebfa63616accb5c6f0
SHA1

b7962c3a23e14019309c3d0ddd20c38cdfdb6dfb
SHA256

50a6e55d056a71e2c4727743dd38e3c5d0d1ad9abca32db3b43c9546bd19341a
SHA512

cae8e7c18065a94fbbe1e5b7baaed36700835a3fefb4d047416cc9bcb76a354565b2f4cb589116762ad09c48367a6c0f69e947b4f87dbabc80747869f26d9552
SSDEEP

393216:+USo++UEBhPQT75d5Zb8RuI1rhMlIPDNQPa0hAcdylFPqC/Dwxd:TdUZ5dTKuMMlILMrjyHPEd

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.brata.rat

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.brata.rat

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.brata.rat

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.brata.rat

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.brata.rat

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.brata.rat

com.brata.rat
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4940