sandrorat | 55ecc1baad15bb10a397ec11b99b559720712eb7e15d13d432e89f6ca0627cc0

General

Target
JaffaCakes118_1bb98ea82d5ae7c3f57cd420b71fdac2
Size 232KB
Sample250705-vg5d8aer3t
SHA256 55ecc1baad15bb10a397ec11b99b559720712eb7e15d13d432e89f6ca0627cc0
MD5 1bb98ea82d5ae7c3f57cd420b71fdac2
SHA1 57e3369d269e1f65fcf9964760305e25b699a879
SHA512 027e521fcb37b4e11d6feb9088935fe4fddf1cbeb2476a8ed131d08c378a5a98ac8d36ccd128a242d45e042629287e0898674b0c1386c661d82138cff158c4b2
SSDEEP 6144:9fBCaYxLZb/WIKy/NM8rT2NUZ2pudX9TV+VnLUpI8koist:9fkfxVb/LKyltrFqujTkVngpIxu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

sandrorat

C2

za3blawy22.ddns.net:1337

Targets

- Target
  JaffaCakes118_1bb98ea82d5ae7c3f57cd420b71fdac2
- Size 232KB
- SHA256 55ecc1baad15bb10a397ec11b99b559720712eb7e15d13d432e89f6ca0627cc0
- MD5 1bb98ea82d5ae7c3f57cd420b71fdac2
- SHA1 57e3369d269e1f65fcf9964760305e25b699a879
- SHA512 027e521fcb37b4e11d6feb9088935fe4fddf1cbeb2476a8ed131d08c378a5a98ac8d36ccd128a242d45e042629287e0898674b0c1386c661d82138cff158c4b2
- SSDEEP 6144:9fBCaYxLZb/WIKy/NM8rT2NUZ2pudX9TV+VnLUpI8koist:9fkfxVb/LKyltrFqujTkVngpIxu
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence
- Acquires the wake lock
- Queries information about active data network
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Acquires the wake lock

Queries information about active data network

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3