Analysis
-
max time kernel
55s -
max time network
153s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
-
submitted
24/02/2025, 22:09
General
-
Target
d54841a13a8b207b01641b07ec4fb0c4e5afa69f304d46c0ce91ad7425a9d327.apk
-
Size
4.1MB
-
MD5
c1704623de4f7a3c743e078b57178715
-
SHA1
3b35b2b650c859d7b8a9adeaeaefb4fa98a21009
-
SHA256
d54841a13a8b207b01641b07ec4fb0c4e5afa69f304d46c0ce91ad7425a9d327
-
SHA512
a849aac4f9415ee77e7c71debc6f760dd9fb65fb5449d6f916a799fe8a9c3d06e7adc93871438ca5bd78737c0aa9194b5fb2d141b22b1ecd690ccf2f94365567
-
SSDEEP
98304:pdHpSFqXO3uieO/AAdo00OgjFAAlA7tpbICbhh64:NScOVeTAFohAAliDbPZ
Malware Config
Extracted
androrat
3.6.98.232:18443
Signatures
-
AndroRAT
AndroRAT is an open source Android remote administration tool.
-
Androrat family
-
Removes its main activity from the application launcher 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 10 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the calendar entry data. 1 TTPs 1 IoCs
-
Reads the content of the call log. 1 TTPs 1 IoCs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Reads the contacts stored on the device.
- Reads the content of the calendar entry data.
- Reads the content of the call log.
- Requests cell location
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Location Tracking
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5bbe24c4110d44a5ec3367e01e75eafa8
SHA1e84912352ace28202fe9334a5902580e6fe253f7
SHA256d5a06b6b4258766a36ce95e95b62e2a689d7ed5f0086a819e876262e80bf3757
SHA512a8551e696ac6c2ee2b6f9dd5b15b5f0e0d41713e60d6aa8692003605ad297fefbbc172e6c4abfbe32b11c0344dc40e49b3dc7e873e95713f8ab7c75ba6a40857
-
Filesize
32KB
MD5b84ca221f49f56ff688fbd77b269875f
SHA12b99d98f4c58523b8c7adf4a2ebdac6a3bb3cde3
SHA2567325ead2e503bb80d341c1796f7dd0851b5089511958f09fcb16dd2af8fce31f
SHA51229860393d2a3a22706a41d286448d0eb10b7d70990f848b1bdbb6f359871dcb4503c4acf3363b8b5addf10ea0289a076085a81669e6ce97801214fd085001ec0
-
Filesize
8KB
MD5ed7c223363a68f0272cf56895f60e885
SHA187ccafc8d59fcf1bbea3d88ebd642b2cd0b490e0
SHA2567df1aeaec5c11367c6aa29af0d43e0be8a0540f2df7a53a0e1f98396def04f20
SHA5124bd9c5b86e702ad2428bf148b5582ccac050d26b4c08809ba550dc537a1ae4607aef369c5962f0f58f559fbb94d8880560b4733e4047e4aa6b0d272ccabe31ef
-
Filesize
512B
MD54d8d986eeacc911945a24a40387bd631
SHA1eebcc5e1a2a5730bb2aa48f1de629a0353804d10
SHA256e7ea475f083b03e1cd15a0b8ac613c4fd5fd73db9730c33214988765eed34798
SHA512e883031889f609ce510d1e10d70885d340cb425897e53f5ca72ba6244b41ae058e24574e0b0e4b459a58538d78d04506e3c486b4ed3fbeff7a85d2b1807902bd
-
Filesize
8KB
MD53453efd17a7727e9afc6f0ce678c58f7
SHA1d1aecdaa766128f5804e85355cea670b9504e87a
SHA256c79d0522b2f683af392147187afad3104d37c5da52cff63a7a732c3550f981b3
SHA512d1153aa1f0e97c3cdbe10f3ebb45163873e0d31c2417c4c411992832e70ff6d46810a6e3cf2adfa8a00b121aabbee1cb62cc9eb7ded7f9402039c4276ab7f860
-
Filesize
8KB
MD58cb9b15e0aba51680b52147c10ab9019
SHA1905594924588dfc73aaed4fbb7e9710fdeb0f8f3
SHA256c4a70223fc8593d6244b2b7f97a4b244df408ee283a905e846e83f0b978aff03
SHA512a19825a089b9a94cedddd86eea3eb747628fbb6684e08fa9d9900f87f47fba09a28727d906af15e31c59d1360f5c8eaed8c2b67b2a168362ce1ff7911e455591
-
Filesize
8KB
MD52d0d5be42675262ce859d90ef6664ffe
SHA1ba7036f9799839d5e1aa1a5053cb5d7bbe106948
SHA2562267efac38440159d39c7eca116404c80405d14e84399f37384a8ce53ef39597
SHA512fdc6ee6e549c1114ec0e7bab1daa20c716bafbe0dcf658f26d9dcb8021b204c2f8101b52dfdc77f7d11c231b15fe7dc42df657933fd54b11a5db4aa04c2b1489
-
Filesize
16KB
MD5c40e9cd8541cc67b9566e02dcf370af1
SHA191474f613c918e661598f8cb901a5e1a3ee1fba9
SHA256488d158bc51b804f03fc234e7e6edb4954657a3ebe8390e123d47144b1617fc9
SHA512a6199b01eee060853f543145ed117de69df550e69668c21b8fbb0b9df4b232963e499dea07725fbca70f63717b5c2fcbee9a9beccfa89518cf0884a2f51f7e39
-
Filesize
512B
MD5f889158ff044bc24e3142d8bb71f0ff6
SHA1bba9bbfdfd3895f21a1e3e6feea29b8d3e1dad9c
SHA2561a63321652bed07fb854631b8a721add930823ae1fd865f1764e642e79f73c16
SHA5124ab9392a2ce78eeab065731a47816070a157fa20d084dafa83c6e784e236a651cf1b4ab2cf291843a70aba664dc9389a151bb7d82bddea2dd7d17603042e486f
-
Filesize
8KB
MD559fb05e044e19d18b40ef13db3bd5be9
SHA128cdfabebcb3de0d21cfc4ee8c3a5ab003736818
SHA256028f068ad903a63babad1b782502a74c350982075b39394b97b06e4de5cb1047
SHA512d1178ee3507b9352d3706e1c3fcdd9999ffa4a4dbd95f57dd0fd0c7e6dfe522738d361c865e2ce76998667477cd54bf8f90c52bc0a9b8b20661562a54b9acb64
-
Filesize
8KB
MD5e2e08e08a562554343ae4abddbf95646
SHA18faf34c71b4539082996225694420a076a0ad634
SHA2565775f33f3cd87ee759827d6ef97f14b7628616059c0a388f0d6be2f25a6c8aea
SHA512ba31e948a675d2b3ab7ed2b2e39174e81222101ce17a73bbe1d924b55456b7812b2cd35d79c43410d55a6d48ac696731c3ef52e816102ec28ab1e9a991585066
-
Filesize
3B
MD558e0494c51d30eb3494f7c9198986bb9
SHA1cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
SHA25637517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570
SHA512b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4
-
Filesize
114B
MD58df93216f15e0456463c663411347c3d
SHA1fe953c4c759631768017e897dfb963bd290b44fa
SHA2565de89c1885cdd3be03d0c66539ad81085a7dcb1214ac3bda4fa74acf08282584
SHA5125a35a6299ae199ad4d0cbb0608a4e8e00a018ea03b7df188e956df477499d55469c6ba7fdd7242d0aae6e2221079b7d4cd27d86dd0d7ae5f3543507229d73b4b
-
Filesize
114B
MD57de70263773cac24d5f0f58fc9f32c1e
SHA1e59b21ae46fa3e98ccedc6e71bce3c64c6986b27
SHA2568f1ffbfc0431a667db58b4399b485641a677fd29882c69866e24ba2d86a49f85
SHA512990fd2a0d3e12eae5fb3cb5def89eada5486deeb02e15cf191a2317723553656e2dab6cf28dd62705bc644d2b16c11e77e9cc74fa325f4eb44fdeb51dc74493d
-
Filesize
114B
MD546dc3d7db427f1f6ae9627d0a6fad7d4
SHA177ed80e6d50eba2de4b124bf26ee2332d7d01ccb
SHA25605891eec42c40cedc4dc741b86972f99b79f575959786185cb41bb93053892f2
SHA51237cb029039a243a5b411fd4d43ef179dfe7f68316596a8cd1f79467a1ec803a347e2ae3430f767b97a5df3a4753bb8890a0424680edf1a59e73ae5a7f40bc20b
-
Filesize
114B
MD51dff833da7f1a80a01cf3b633f2eea22
SHA10b42eedfecb8bb77c9ad1cae743871404a231043
SHA256dbc4a041a985f0085df9493c8523f56a17bbc1ca44d38bfe0e009b4368032e41
SHA512e7edeb10c403917f04f6ec3acd653942f413e28a5cbb37d018ce2bebf29b5244d21cb414501d18f231c65f263bb672df1edd90b8f99a5d95f01ad3a0afa2e2f0
-
Filesize
114B
MD500de8f8514cb5cfae1bbe14158691dfa
SHA1db4ec28f776830989094779c880cb3b829b2cb65
SHA25633eda954e9d5b52c03fe798394c234456bbb5970d2daf8af74ab344d57220bd3
SHA5128faa171e5825abb4d31bf87b6ca076cab0fca3b9016c933adf66048450ef15394e2f873d75cb65beee66a8bd2ba55123af0dbd7e9284922bd9342c57726dc73d
-
Filesize
477B
MD5a6c5a0ee4c027fcb6798d1ab574108a3
SHA16054a71fe39fe6d53881974bf24b3ab495a06d7e
SHA2567285a07f901f7fc3dd0bbaa82e32bf3dc9eb9e2df9c4ba52834973ea7ca141b5
SHA512aca0918a9e7386e6a7d4a22bedce465aa168ddd17f8ad4cd36297e581319119c1ec508dde98e371bc0b27d963468b2691a623d227a14956e9b8124ae173ad59f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD58f651130f3346357b918a43d6854600c
SHA1c139fe19d9ab5bf38ca3fef577c5744c94191c6e
SHA2568114a51cc598075b98e01dc479b4e8ba0335663ef9761bf14b2aa0f7f463a16e
SHA5122b203d22e7811ecb82f2f1bee6c121dbe2a5e86f307765efce7a943fa2f53d9a795153e31db7eea39e536717a5dc67b07a2e38dc299025057eeb8cc26aa2e743
-
Filesize
11KB
MD56c67d94a917ade34763ebcf52fb291a2
SHA1bbaa4ca101fad9f7723aac9ac264ac93ea8debcf
SHA256bc11e58a0aecd911956f5b73acbd16c0bb5b2936cf0507b15c21cdb4d6107fb3
SHA512aa89ff8308b53a0fd19fd19fab5a5664def071d112d2469f38ff7293a65566a670aa06f4a6c9d92e8eb34aaa8ed523fab2b38a6acfee102b7e2051540630588a
-
Filesize
7KB
MD5effbc10b41f027e5c2130835d524c99d
SHA1affb65361d7a36d00e402ad869696578b5ac3259
SHA256566fb91b6bf186c05c4ec051aa2e2802961cbb158df24a8fecaa0678febece84
SHA512b2ddd0142a80663097e9b71d8d654d88382ef8f765c92f0c8fbf600f1174cb1b1e9e61088f954e609e6d2402fd4750b88945af7c1080018b991f2e6e6d9ad52a
-
Filesize
4KB
MD53748dfbaeae0d43d38471f14e4321dcd
SHA1a5a6dcb2e325479cb25a44cb66216e09a843666c
SHA2564830f1d48d41c7725686901a2d4f93a8ea722f6160dfecc6815ac85598e361db
SHA512bde4b86489abafb3a5aff955ce232367044b6fdf106ea02847c3dbd78e49a02dd7c63bf82c26a3b630962aad16a877ece85af74608909a37a89b0591e012625c
-
Filesize
3KB
MD5514d884ca8bb12d1b8f440f3e64c3f9f
SHA16242b72c85ce2a287e95fb2522afe1f559b277aa
SHA2565a9b87d66daf4ad4791d980d9c3270c7806bc18c89e323472a500fb8ebfefc5e
SHA512c18018ecb5742753f72dbe369c6f21b391b514a3d0dda2ef404cd53be299c42f3c774c7bec085d7c5713d42cf0fdb2f9e629d6cf5d635d3ca9271147e8420ac2
-
Filesize
5KB
MD5a6fcd52b6b66cecf6862b4f36341bc04
SHA18b21ceb4d264f40cf7da42ce630c991a0eea4090
SHA25647bb8e56ea3c98e4a3a8b1e557e8b8d7683683e6657df223907b7c1ef085018f
SHA51290ed714810ad62ef12e861506814f595db1c407aa5d2ee659e0bf5fb67cc1d8bcfc5bd776c82ea7fc0e6cdb21e25e4fc0399e90bfdf666a2296769bdfb0efce9
-
Filesize
4KB
MD56b2bac966edac0048bac4336dd7ffdab
SHA14fa290b1ae3d09a70f29e05ac33701a937307a29
SHA2569a0285c31c82617f5d5823210791ab57fa29c92ca8107b0fa0e7a7a35be96af8
SHA512758a90200d4f08c263d52c931a2cdc9ce066d87c89f786e04b56cc90bdfce7918001db0349e7a037c5e79a7eeb9d3f6e43c661d37c0cdda43f7bf2853d63f4e2
-
Filesize
28KB
MD59506c5cbfc8e3e59fe9b9d52bea1ddd9
SHA1b7ff5d775666cd07120ea14569dc00527cc53d1f
SHA256725cce101997a2608c3a1b51de805caa6cfd7f9c8c84420d4b68135227b49edc
SHA51244445051d25ab0188ec7233c97680a279c2d717a436966d8cd90153747a7dfafb7d39c5bda72acfafdef9f674e2de500723134c08cde76d885cbeab69bca89e0
-
Filesize
22KB
MD560c5153ac9209d93ec6f5dad798b520e
SHA19405c5f69f3038fc22724d611a0cedafbd0865b4
SHA25630770d032694d585243cf2c108ddb515a11cce020953b3a8d1304d7704101c0a
SHA512dbbd90a413c223f96be511409e82cfb3436df588ff58e4f21e5ae0610541bce191b8468179be6dee57b25438d7f1266b93b5639a7249c63050030c9ead36a093
-
Filesize
7KB
MD51a26c5544e9f9f82b3c020c49162764a
SHA13689b5b26e85472785082c3f879da9bcbba22655
SHA256d365285ec8822cc96ffa79d9596e03bb0fef3bcff4d2cf9b890340fec6458459
SHA512d240e89ce386672b339d8c72b64bc41106b326b4d592ad2dd4aa3ac449a8e5d4930fb705d104f0ee8831ce188e54a644fbde0d3e2da1d788f83781bbb02a5f0f
-
Filesize
9KB
MD529b80b15673d46bfda32d7beaf2457b6
SHA1cda13c92638243b9116d3ddeb49c792a6b5369bd
SHA2562b111730487405bef3ad063f3bad8bcbe409fac4ee00c08ce6122b27c6298254
SHA5121810eeb08a7fc3be4ea0648aae082cea2bca5987972d65f82bd427025fe055c4c1942f2c045a9a95cbfaa60f64d436d6528337f34602c63362ed895c0d92210c
-
Filesize
5KB
MD542602d32a96f59366c36ca9dac5ce28d
SHA19690c0c6510cb5c7be9182d41dad381a1262065b
SHA256e15552b3ab0824370ff36e1ee461251d72fef39ab75722a56064259049370b3e
SHA512ded18e20f4b4353ee5e65f96a0d8297dc1f7f5802a18332de7fa3aaf6f4cb9b81982cb266c6779e9b1c4791aaa4eb8e04e3214b792c0a98b69a41654158684bb
-
Filesize
3KB
MD5b0fb4b4b85453c7413ce34f558dde399
SHA1e64d0e87b0baf84cc2c7e4c4dc1cfe8adcf9376f
SHA256ad712097c583f970a7490dcd56f6c85fb3398dc6a5922b8477617fb741385eb0
SHA512a02ddb7cccd7a820f059c9aa0869d1258d6cd4e1772dbda41d50c967f0da934223d304c4d4ec914b2dfc6b3fb0edbc40b45b2bce68915a312dc0140358dfd036
-
Filesize
4KB
MD524187c8d4a921022947272a9803b3f41
SHA11620aadbdbcd4adebe67316e89e8c65d1f61b8c4
SHA2565468034e8a0355df93f6b070a8025304900219588f6c946f4ad37ba5750a53c0
SHA512aa1ecef797d063e091c0e149747f331b90051c007cedaee72407f0c533e25086f2a6bdcc3ea4a6686ca595ab9ef577ef11bcd14c0fc26daa5f8f76ab513a3978
-
Filesize
3KB
MD536d7729b8cc8ace6afcc472b3f1220db
SHA13f1d7cb1dd721cad2cf955303872e3bec883968e
SHA25658d71a9c91d09e4a5e3cbf4c543daf97e8f2ce31295efb6547d3eb535bd9a148
SHA512e98135aee684654d62bccac9014d8d15b6d1cddcf303aef10c31d9352ed3fde35c922341ce5d7245e38d8d53c022ecb7953a59632873915af211df90784fa621