Analysis
- max time kernel
150s - max time network
158s - platform
android_x64 - resource
android-x64-arm64-20240624-en - resource tags
- submitted
16/01/2025, 22:07
General
- Target ab71f92c8db193aa8ffe8991c55dcae492c172766015ea73faa2c5faa75aaec5.apk
- Size 4.1MB
- Sample250116-11xrdaskgj
- SHA256 ab71f92c8db193aa8ffe8991c55dcae492c172766015ea73faa2c5faa75aaec5
Malware Config
Extracted
-
androrat
-
3.6.98.232:18443
Signatures
- AndroRAT
AndroRAT is an open source Android remote administration tool.
- Androrat family
- Removes its main activity from the application launcher 1 TTPs 3 IoCs
- Loads dropped Dex/Jar 1 TTPs 15 IoCs
Runs executable file dropped to the device during analysis.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
- Reads the content of the calendar entry data. 1 TTPs 1 IoCs
- Reads the content of the call log. 1 TTPs 1 IoCs
- Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Reads information about phone network operator. 1 TTPs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
apk.manager-v1.rizal.xml
Dname
Dname-journal
Dname-journal
Dname-journal
Dname-journal
Dname-journal
evernote_jobs.db
evernote_jobs.db-journal
evernote_jobs.db-journal
evernote_jobs.db-journal
CallLogs.txt
GP.txt
GP.txt
GP.txt
GP.txt
GP.txt
GP.txt
Tree.txt
accounts.txt
netinfo.txt
netinfo.txt
netinfo.txt
pkinfo.txt
Û¦Û–Û«
Û¦Û–Û«.
sysinfo0
sysinfo1
sysinfo1
sysinfo2
sysinfo2
sysinfo3
sysinfo4
sysinfo5
sysinfo5
sysinfo6
sysinfo6
sysinfo7
sysinfo7