888rat | 2e3f5b2d83c3844d534e4ec9481016c2acfa26813b54471a26003c34ef26f11b | Triage

Sharing

General

Target

2e3f5b2d83c3844d534e4ec9481016c2acfa26813b54471a26003c34ef26f11b.apk
Size

2.0MB
Sample

250324-etj12swxf1
MD5

f918a04746221391097df07f678dfe1c
SHA1

90f3cb9df315c926fb42c7f0353ed664f00abb8c
SHA256

2e3f5b2d83c3844d534e4ec9481016c2acfa26813b54471a26003c34ef26f11b
SHA512

514c7c0a5a6709f5c492f5d76e20205643d23b903c078d01f6ceced61907b35f5ed7ae0f55527280fa3695428966298a64c26422111766c431d6f44c88c0a589
SSDEEP

24576:Z9pTK6uR0fZ7Q1eY8sl5pKBCI7WXkKF8scWVKUOZOUvBZRvL34ShdHplRaV5HKWT:FduR0fMSSKnyUNWjRCBZfHEVBKTTply

Score

10^/10

888rat android defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Targets

- Target
  
  2e3f5b2d83c3844d534e4ec9481016c2acfa26813b54471a26003c34ef26f11b.apk
- Size
  
  2.0MB
- MD5
  
  f918a04746221391097df07f678dfe1c
- SHA1
  
  90f3cb9df315c926fb42c7f0353ed664f00abb8c
- SHA256
  
  2e3f5b2d83c3844d534e4ec9481016c2acfa26813b54471a26003c34ef26f11b
- SHA512
  
  514c7c0a5a6709f5c492f5d76e20205643d23b903c078d01f6ceced61907b35f5ed7ae0f55527280fa3695428966298a64c26422111766c431d6f44c88c0a589
- SSDEEP
  
  24576:Z9pTK6uR0fZ7Q1eY8sl5pKBCI7WXkKF8scWVKUOZOUvBZRvL34ShdHplRaV5HKWT:FduR0fMSSKnyUNWjRCBZfHEVBKTTply
Score

8^/10

defense_evasion discovery evasion impact persistence privilege_escalation stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests enabling of the accessibility settings.
- Tries to add a device administrator.
  privilege_escalation impact
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Foreground Persistence

Hide Artifacts

Suppress Application Icon

User Evasion

Credential Access

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionimpactpersistenceprivilege_escalationstealthtrojan

behavioral2

defense_evasiondiscoverypersistence

behavioral3

defense_evasiondiscoveryimpactpersistenceprivilege_escalation