Overview

overview

10

Static

static

6

d54841a13a...27.apk

android-9-x86

10

d54841a13a...27.apk

android-13-x64

10

Analysis

  • max time kernel
    36s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    24/02/2025, 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d54841a13a8b207b01641b07ec4fb0c4e5afa69f304d46c0ce91ad7425a9d327.apk

  • Size

    4.1MB

  • MD5

    c1704623de4f7a3c743e078b57178715

  • SHA1

    3b35b2b650c859d7b8a9adeaeaefb4fa98a21009

  • SHA256

    d54841a13a8b207b01641b07ec4fb0c4e5afa69f304d46c0ce91ad7425a9d327

  • SHA512

    a849aac4f9415ee77e7c71debc6f760dd9fb65fb5449d6f916a799fe8a9c3d06e7adc93871438ca5bd78737c0aa9194b5fb2d141b22b1ecd690ccf2f94365567

  • SSDEEP

    98304:pdHpSFqXO3uieO/AAdo00OgjFAAlA7tpbICbhh64:NScOVeTAFohAAliDbPZ

Score
10/10
androratevasionexecutionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

androrat

C2

3.6.98.232:18443

Signatures

  • AndroRAT

    AndroRAT is an open source Android remote administration tool.

    trojaninfostealerratandrorat
  • Androrat family
    androrat
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.tencent.mm
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4263
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.mm/app_mph_dex/oat/x86/apk.manager-v1.rizal.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4326
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.tencent.mm/app_mph_dex/oat/x86/apk.manager-v1.rizal.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4399

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml
    Filesize

    5.9MB

    MD5

    bbe24c4110d44a5ec3367e01e75eafa8

    SHA1

    e84912352ace28202fe9334a5902580e6fe253f7

    SHA256

    d5a06b6b4258766a36ce95e95b62e2a689d7ed5f0086a819e876262e80bf3757

    SHA512

    a8551e696ac6c2ee2b6f9dd5b15b5f0e0d41713e60d6aa8692003605ad297fefbbc172e6c4abfbe32b11c0344dc40e49b3dc7e873e95713f8ab7c75ba6a40857

    Download Submit

  • /data/data/com.tencent.mm/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫
    Filesize

    3.0MB

    MD5

    c878f4fd98ccf64775a0b0a6e9f558b0

    SHA1

    5074117e574373371d0481e1fcc2ecbaf67d5bbd

    SHA256

    19cbb79dabd98b893fdfb56aa6c053abad9bb6c1e99b76f70daae9cfad2bfbe4

    SHA512

    9ff99b2c911bccdec4b5a4b9f4a32ef6fc234ebf174001f2aac102d27b8b98d73ca1da31671d822eae74f21ee752ffd20d1125a38a6f7727e9061690b6b7a989

    Download Submit

  • /data/data/com.tencent.mm/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫/ۦۖ۫.
    Filesize

    8B

    MD5

    9b4a743c0797017d478081255ad1d461

    SHA1

    cd13826884ae92ea61eb45492d03e2014f01ecd6

    SHA256

    e1225dac458a41aa015af24a2103542e6d9bac8d0d26601707f557fd0bdf75ce

    SHA512

    dfaa0d3926aa0386e63ae839840b2fadfafcc55c1bb5bd0887a928a1216c3931e4cea44f163353156b24762f0c6a02399f6cf26a98363547d70c82f6c48d6b8f

    Download Submit

  • /data/user/0/com.tencent.mm/app_mph_dex/apk.manager-v1.rizal.xml
    Filesize

    5.9MB

    MD5

    9cec5d29a92ba8c078263c597c10b476

    SHA1

    fd759c66b56450174a86a4e602c48f5b20ea3442

    SHA256

    8bcbf0f407b480288dee410708c3fbbcc49f2094b67000add37bd548a3090c68

    SHA512

    0a76135b4aa44f604595de62ee5959d6bb85e902787b0116f826877c6b54ceec6fc6d3cf6a0a303612ddadbbb12bacd52291f89525d0101d284f41f512db17ff

    Download Submit