General

  • Target

    7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68.apk

  • Size

    3.2MB

  • Sample

    250209-c16saatqbk

  • MD5

    1b69285c1135ad439baf7da8a7dae91b

  • SHA1

    1899663f322d01050e33f37c478c08bc09294f0c

  • SHA256

    7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68

  • SHA512

    495ec0623cfebc141d2d1d522938d3e46db896ee12e5a7f8f9246d6e525c32995c047d3ea0e86e002d7e2ffee9e963bd90e3c38cf641cf1140ee688c938223e3

  • SSDEEP

    98304:q95TvYRIKePOg6JxjwEBISSddXCEYp7k3XEjp:QxvYRIPOSe4XCF9

Malware Config

Extracted

Family

craxsrat

C2

:

Targets

    • Target

      7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68.apk

    • Size

      3.2MB

    • MD5

      1b69285c1135ad439baf7da8a7dae91b

    • SHA1

      1899663f322d01050e33f37c478c08bc09294f0c

    • SHA256

      7336d69db60d8b7a9113f3867c764e6b438afc7024b30610e465a7e9499ade68

    • SHA512

      495ec0623cfebc141d2d1d522938d3e46db896ee12e5a7f8f9246d6e525c32995c047d3ea0e86e002d7e2ffee9e963bd90e3c38cf641cf1140ee688c938223e3

    • SSDEEP

      98304:q95TvYRIKePOg6JxjwEBISSddXCEYp7k3XEjp:QxvYRIPOSe4XCF9

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries the mobile country code (MCC)

MITRE ATT&CK Mobile v15

Tasks