Overview

overview

10

Static

static

6

9df047c6c0...e3.apk

android-9-x86

10

9df047c6c0...e3.apk

android-13-x64

10

Analysis

  • max time kernel
    14s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    17/01/2025, 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9df047c6c0aa2e41583af597798157578be1061cd4928576f416c878ff5799e3.apk

  • Size

    4.1MB

  • MD5

    aeee571dad8f7554d81bfeeac515764d

  • SHA1

    cbc7176336dd03105aee7c57442f42b61b9d96e2

  • SHA256

    9df047c6c0aa2e41583af597798157578be1061cd4928576f416c878ff5799e3

  • SHA512

    4ce64b6483b057d32b2097aaeb3d6b85a3f80eff190be07332dfb7d195ec257ae41a06df00fbf1b15b15668744b1e9681612b67edae40e0e7f9f510e2bd5598a

  • SSDEEP

    98304:WDnLvW+D1LAowJkdAg2JNp689TZcIlIPQhh685Bm:WrQkdAg2n797h69

Score
10/10
androratevasionexecutionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

androrat

C2

3.6.98.232:18443

Signatures

  • AndroRAT

    AndroRAT is an open source Android remote administration tool.

    trojaninfostealerratandrorat
  • Androrat family
    androrat
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.tencent.mm
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4270
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.mm/app_mph_dex/oat/x86/apk.manager-v1.rizal.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4332
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.mm/app_mph_dex/oat/x86/apk.manager-v1.rizal.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4379

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml
    Filesize

    5.9MB

    MD5

    c018278da756f85b6fd15c539cfb8a97

    SHA1

    a4c1229550dac47f048bd971d4e432c7d8e1be5f

    SHA256

    fe3c554585d8b20474ce5ad3008f00e5526307c2b1e6f273b95510c000443f6f

    SHA512

    10c3ecf9ab6b92dd91a60e42dff320068c42b2f853460b88aa88ec378ae3efc6fe75f27f11eeddf313cc7d99a34acbcb3c998b0f9d668d74d96141f8b7a11310

    Download Submit

  • /data/data/com.tencent.mm/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
    Filesize

    3.0MB

    MD5

    962d4011e0666996c837efa7d750f217

    SHA1

    6d468c99e9c3ea8e506d6169495b00f14e24b690

    SHA256

    a5839c587d77a4be3daf4003048adc02a5c65fc52d99bbc349981578f821baa4

    SHA512

    a3953116ca4a68426b0ab57c93d40f7393e3c33ea834559a8d2a67cdc62d7353ec77776b5b946e283deeb5adf94c791e915592647193728aea6f5d5103a5dbb8

    Download Submit

  • /data/data/com.tencent.mm/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
    Filesize

    8B

    MD5

    7ff6baacec55a804ae51a9d6c3ad30ad

    SHA1

    c4a110cb7b6eb52083f096fdb7190f0913fdec12

    SHA256

    3db2dd76f3aab7a5f56ad5e8cfdb15e3d1eac8d1e88c41e3d5e1a5f0cd06f54a

    SHA512

    d76524e6800a1bf7ef5fadd735b7b975a0a7df55c07807b9935235334e4bd37350cc53bf98a22e2bd35019dcbce6b0d75480efc5e012e085330d92f88829bf9c

    Download Submit

  • /data/user/0/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml
    Filesize

    5.9MB

    MD5

    e887e895ca08c8067f887a14a6d14052

    SHA1

    fd085fc9a1217b5bf3bfc00715dfd8e428004f0d

    SHA256

    4066590b20d80c3a0c5edf78dbb273aa98ca044cf43e15a5beada727362419a3

    SHA512

    3139f507018427c7672ca6379beea8bda8dc52ae26fbab6d86ddf385d2cfd441b17cf830240fa9755e8ed17bc6642b89d04c696353d9e7f118c1e6dfc8ed76f9

    Download Submit