Extracted

Extracted

• • Target

    HappyMod-3-1-5.apk

  • Size

    17.4MB

  • MD5

    0ef4f4f011c3e16e18b18584d2f40393

  • SHA1

    d4a1292884579509009f85fbe480e819f4e103a9

  • SHA256

    a7e864470fc10ae55241364ce076007552af9673177e15caf4c20062bfc7339a

  • SHA512

    a85a12907e4a3b5bae1d80771817798c123688c2b4fc1945efdb65ff9d1ad4168186add6c55ae4ade9a969c9e0f67cab2672031aafbaca76386e74357211636b

  • SSDEEP

    393216:zp0TcbMT8whcEb7NqnKdzbspDNx4GhY6qqoe2w+FCropPvAUqfE:zacQTvcEUnKRwMGm6qqf0CkpQUqfE

  Score

  10^/10

  crimsonratdarkcometmetasploitbackdoorcredential_accessdefense_evasiondiscoverypersistenceratrezer0spywarestealertrojanupx

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Crimsonrat family

    crimsonrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1