dogerat | JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

General

Target
JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a
Size 3.0MB
Sample260515-tev74acy5t
SHA256 3057caca88807270b93142eb314755dec69d7cbe09fe7b9d78dce5e5c7ef4913
MD5 0334eba56e362dfa8c4aba3ee202624a
SHA1 acf7ded10113927a7077bffe50346d7a2387e971
SHA512 596e6c3d2a42bf90f30470cf69cfbe3c71a0420232539d4fab74dc9af5282c439dd8a49ea01ff2fd3286690dc9257c70849231179ce839d81326f966612de78e
SSDEEP 49152:DVmupryDHH0D6gmPOroTV8asMbUCRtNwaQut1xceJ62g1XSefUwKv2SC32p:DRrWn0DAOroTV87w8aBqB2etU4Sbp
TLSH
T1F1E52225FEAEE426D203E078B169D5879D044A0D4B08FA9F1B2591CC1EFAD44A743FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat dogerat

Malware Config

Signatures

Family: DogeRat
DogeRat is an open source Android RAT.
trojan infostealer rat dogerat

DogeRAT payload 1 IoCs

resource	yara_rule
sample	family_dogerat2

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

File Explorer

JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

.apk 3.0MB

JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

SHA256 3057caca88807270b93142eb314755dec69d7cbe09fe7b9d78dce5e5c7ef4913
MD5 0334eba56e362dfa8c4aba3ee202624a
SHA1 acf7ded10113927a7077bffe50346d7a2387e971
SHA512 596e6c3d2a42bf90f30470cf69cfbe3c71a0420232539d4fab74dc9af5282c439dd8a49ea01ff2fd3286690dc9257c70849231179ce839d81326f966612de78e
SSDEEP 49152:DVmupryDHH0D6gmPOroTV8asMbUCRtNwaQut1xceJ62g1XSefUwKv2SC32p:DRrWn0DAOroTV87w8aBqB2etU4Sbp
TLSH
T1F1E52225FEAEE426D203E078B169D5879D044A0D4B08FA9F1B2591CC1EFAD44A743FDE
MD5 SHA1 SHA512 SSDEEP TLSH

android

DogeRAT payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

a3d225fe189a8ab1ff890ee794035d0ae7e044de1110d3e5cd5513238a39ad33

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.tencent.mobileqq

Android Permissions

JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

Permissions

android.permission.REQUEST_DELETE_PACKAGES

android.permission.QUERY_ALL_PACKAGES

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.VIBRATE

android.permission.RECEIVE_SMS

android.permission.WAKE_LOCK

android.permission.READ_SMS

android.permission.READ_PHONE_STATE

android.permission.SEND_SMS

android.permission.READ_CONTACTS

android.permission.FOREGROUND_SERVICE

android.permission.WRITE_SMS

android.permission.CALL_PHONE

android.permission.INTERNET

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.ACCESS_NETWORK_STATE

JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

File Signature issue

com.tencent.mobileqq.pe68837fe

com.tencent.mobileqq.p1a561a3b

com.tencent.mobileqq.p436dbfd4

com.tencent.mobileqq.pdd4f2ff0

com.tencent.mobileqq.p2e25ec69

com.tencent.mobileqq.p1834e5c7

com.tencent.mobileqq.p5ac58bb5

com.tencent.mobileqq.p2bc32733

com.tencent.mobileqq.pd1c4396e

com.tencent.mobileqq.pa5234fd9

com.tencent.mobileqq.pec08273e

com.tencent.mobileqq.pb601e383

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a

File Signature issue

com.tencent.mobileqq.pe68837fe

com.tencent.mobileqq.p1a561a3b

com.tencent.mobileqq.p436dbfd4

com.tencent.mobileqq.pdd4f2ff0

com.tencent.mobileqq.p2e25ec69

com.tencent.mobileqq.p1834e5c7

com.tencent.mobileqq.p5ac58bb5

com.tencent.mobileqq.p2bc32733

com.tencent.mobileqq.pd1c4396e

com.tencent.mobileqq.pa5234fd9

com.tencent.mobileqq.pec08273e

com.tencent.mobileqq.pb601e383

Android Permissions

JaffaCakes118_0334eba56e362dfa8c4aba3ee202624a