btmobrat | 08e677e41d940069da62cd026fddc0d3bdc9df5b46e7df8b59d6b386b82cfcd0

General

Target
SamsungFE_2102x_update.apk
Size 20.7MB
Sample260728-wevmns1gnd
SHA256 08e677e41d940069da62cd026fddc0d3bdc9df5b46e7df8b59d6b386b82cfcd0
MD5 5353f0603fb923a543ad4f020072f3a7
SHA1 45d967efa7fdaa0274d4c3ea4e1e9cda8279e1f3
SHA512 aa49c6847742ac90c9278e0a0eba8eed919332efe6cf0c18b131148d2b4a9bfd3aadaba68fc7df78a94ca9dc4d0b4036efcaf5148fad418b22aa8b0115767ffc
SSDEEP 393216:oN8M2TJ+BkEpZUI4UjUmacAiK+34LqUQ1FvdwmTOmw3gMac0b:oN8rdLKZp4Uj8cAiLI9QL+mC+Mm
TLSH
T1F4272387FB80992AD0F783B2453A5321550B4C668B43DAC77D54313C28B7AD86F9EACD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SamsungFE_2102x_update.apk
- Size 20.7MB
- SHA256 08e677e41d940069da62cd026fddc0d3bdc9df5b46e7df8b59d6b386b82cfcd0
- MD5 5353f0603fb923a543ad4f020072f3a7
- SHA1 45d967efa7fdaa0274d4c3ea4e1e9cda8279e1f3
- SHA512 aa49c6847742ac90c9278e0a0eba8eed919332efe6cf0c18b131148d2b4a9bfd3aadaba68fc7df78a94ca9dc4d0b4036efcaf5148fad418b22aa8b0115767ffc
- SSDEEP 393216:oN8M2TJ+BkEpZUI4UjUmacAiK+34LqUQ1FvdwmTOmw3gMac0b:oN8rdLKZp4Uj8cAiLI9QL+mC+Mm
- TLSH
  T1F4272387FB80992AD0F783B2453A5321550B4C668B43DAC77D54313C28B7AD86F9EACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution btmobrat impact infostealer persistence rat trojan
- Family: BTMOBRAT
  BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
  trojan infostealer rat btmobrat
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1