888rat

General

Target

yes.7z
Size

37.3MB
Sample

250117-wd21csypcq
MD5

028d808e644a4499b62cadb5106f54d8
SHA1

58fc0d31ded82d8fd6d3aac9cefd2fbdd7236df8
SHA256

dd2c7f46e8f070fcc9ef66271e2741d07bf2ba59c40790751d9fa32b8296881d
SHA512

0368eeb8af3fb1a6e0f7f66c86fb2d91a5fd1393c30f2ad8a042d771fc2e77fac6c35cbe288cc23944ff6f1a0c9e5c84202f7f4ef9adaa8ce99d4d72610a6b39
SSDEEP

786432:6bAVFSMAPH/sldSJUo5c67RlaBsyvIY5vtGPlMO8:6bAVg/PHsoq60swh5gm7

Score

10^/10

Malware Config

Targets

- Target
  
  888_RAT_1.0.9 Cracked by Shark M!nd.exe
- Size
  
  22.0MB
- MD5
  
  32004e656640aad1672f0ee98434bc3c
- SHA1
  
  d665b4e03e9d75f87079d65cff791147b7ee6e4f
- SHA256
  
  beb837e8832f27dacfd3719cf617310f1b9e74badbfca8705ecafce3ed5e6a33
- SHA512
  
  1cd55008d6352469a937f168d6d72cfd202d81c24a6be4c6256a4c73c576577aefe8da912c5cb09e12f12a58e46f99381fa9834b58bc356e0c530908b236785f
- SSDEEP
  
  393216:TufwMCigvYFChWbRT5OV7lAUl+9o0okMLeDuq3+QAk5ubWWBwBvJ5wV:aXZgvYYhQDOVPl+9l2+OZuhQwR/
Score

10^/10

discovery upx 888rat infostealer rat trojan
- 888RAT
  888RAT is an Android remote administration tool.
  trojan infostealer rat 888rat
- 888Rat family
  888rat
- Android 888 RAT payload
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

888Rat family

Android 888 RAT payload

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

AutoIT Executable

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2