General
-
Target
69ae5079f26908ff840960dc5bea1d055d3b1bd78318102a4e64b605ee7e4ff9.bin
-
Size
4.1MB
-
Sample
250205-1yqkaawkbr
-
MD5
45b5377f3a42484d5391af34ad47785c
-
SHA1
8fb49e59b8e025a70be935ad0a720a677ca1031d
-
SHA256
69ae5079f26908ff840960dc5bea1d055d3b1bd78318102a4e64b605ee7e4ff9
-
SHA512
e22e285dc0b4739d191f3be9e339e7076af02e0f907cbebb0d7fb7c7584f7c741e7b8ff3c7993bd4672d0308a7f82ff41137fbbf4e4c6fc5fb5cf7611c01f034
-
SSDEEP
49152:ygmPDdoPGRo5X3meyRZJyYVza3qc65Kt6u7wpymvMfVVW9BX5pgtflZMekqeDj0V:WD6hbYZkLjtB7fTg7gdlVkXjvYCZAz9F
Static task
static1
Behavioral task
behavioral1
Sample
69ae5079f26908ff840960dc5bea1d055d3b1bd78318102a4e64b605ee7e4ff9.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
69ae5079f26908ff840960dc5bea1d055d3b1bd78318102a4e64b605ee7e4ff9.apk
Resource
android-x64-20240910-en
Malware Config
Extracted
androrat
3.6.98.232:18443
Targets
-
-
Target
69ae5079f26908ff840960dc5bea1d055d3b1bd78318102a4e64b605ee7e4ff9.bin
-
Size
4.1MB
-
MD5
45b5377f3a42484d5391af34ad47785c
-
SHA1
8fb49e59b8e025a70be935ad0a720a677ca1031d
-
SHA256
69ae5079f26908ff840960dc5bea1d055d3b1bd78318102a4e64b605ee7e4ff9
-
SHA512
e22e285dc0b4739d191f3be9e339e7076af02e0f907cbebb0d7fb7c7584f7c741e7b8ff3c7993bd4672d0308a7f82ff41137fbbf4e4c6fc5fb5cf7611c01f034
-
SSDEEP
49152:ygmPDdoPGRo5X3meyRZJyYVza3qc65Kt6u7wpymvMfVVW9BX5pgtflZMekqeDj0V:WD6hbYZkLjtB7fTg7gdlVkXjvYCZAz9F
-
Androrat family
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device.
-
Reads the content of the calendar entry data.
-
Reads the content of the call log.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1