888rat | hxxps://telegra[.]ph/cdbfam-09-25-2

- Target
  https://telegra.ph/cdbfam-09-25-2
Score

10^/10

adware defense_evasion discovery 888rat infostealer persistence ransomware rat spyware trojan upx
- Android 888 RAT payload
- Family: 888RAT
  888RAT is an Android remote administration tool.
  trojan infostealer rat 888rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1