7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e[.]apk | Triage™

Analysis

custom tags

ratspywaretrojan

Sharing

Copy URL Twitter E-mail

General

Target
7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e.apk
Size 10.9MB
Sample260817-dwp5eahc32
SHA256 7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e
MD5 7622b200c3e9c4a12413b965b67a8ff4
SHA1 e99fecf4e9edef9c7b44ef2181a814d093da48d5
SHA512 23c9557dd9e999ecab15038314f4198093e8b5c10ad66a1f1151f73ad3ab35aa7d14e1e837e9adbf82fa3ea9d0fb92da337cd84f29a1e4fd26f524bc12323730
SSDEEP 196608:7nB2N9RArFb+/nerbOoOpTik4rhRRplJRjWO1o2rkROBHx7okTT6mm2/vEqN/7aE:7QHarFbCnwtxHDlrjpL+ePdcWaLOp
TLSH
T176B63396AB40563BC876443241AB4B2277A76D9985A3DB1F3A08710CBC73A4C1FFDE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat spyware trojan

Malware Config

Signatures

Commodity Android RAT builder stub artifacts 1 IoCs

Contains namespace or class-naming artifacts emitted by off-the-shelf Android RAT builders. These kits generate a fixed package skeleton per campaign, so the stub markers persist across operators and configurations even though the C2 and payload settings differ.

rat spyware trojan

resource	yara_rule
sample	ANDROID_CommodityRAT_BuilderStub

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e.apk
unpack001/1_f5558645c8.cat

File Explorer

7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e.apk

.apk 10.9MB
1_f5558645c8.cat

.apk 9.4MB

7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e.apk

SHA256 7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e
MD5 7622b200c3e9c4a12413b965b67a8ff4
SHA1 e99fecf4e9edef9c7b44ef2181a814d093da48d5
SHA512 23c9557dd9e999ecab15038314f4198093e8b5c10ad66a1f1151f73ad3ab35aa7d14e1e837e9adbf82fa3ea9d0fb92da337cd84f29a1e4fd26f524bc12323730
SSDEEP 196608:7nB2N9RArFb+/nerbOoOpTik4rhRRplJRjWO1o2rkROBHx7okTT6mm2/vEqN/7aE:7QHarFbCnwtxHDlrjpL+ePdcWaLOp
TLSH
T176B63396AB40563BC876443241AB4B2277A76D9985A3DB1F3A08710CBC73A4C1FFDE5C
MD5 SHA1 SHA512 SSDEEP TLSH

android

Commodity Android RAT builder stub artifacts

Contains namespace or class-naming artifacts emitted by off-the-shelf Android RAT builders. These kits generate a fixed package skeleton per campaign, so the stub markers persist across operators and configurations even though the C2 and payload settings differ.

rat spyware trojan
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

8f5717589dfe6fefcff61279839ae90908f2fcd24769f540693bd3043f90bf5f

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,OU=Android,O=Unknown,L=Unknown,ST=Unknown,C=US

com.uxczdxbhi.vmbzocrqf

1_f5558645c8.cat

SHA256 8daf9ed069291b148847ebf8ddb01d6e5dfa32ddc13117497cb94362e9e222b8
MD5 b85f43c7ed38d7217e7413a5661bdb6c
SHA1 0b9915c68c173f461f2356145c19abf269b0e120
SHA512 efe8e97d8370827db2886331fe2d27b18d1d065bd7d08c04f1d68c31de9a397ea6c066d89fa587a788f69673166182da67f092dd1fb2b4eb4f1cd4728a9c7d62
SSDEEP 98304:zk3tooj7GVKwC5iSRGAPRsGFa7Bdn+p0PIfEiLRTLs94dy2A4P7dTRBVLlnlwnWT:g3t/j7GU7rNRY7T5iZIS5V7hRBHlZ
TLSH
T163A6C01777864F39F88D7934814F13378513B91967A151DB096BC100EE2EBF2AEB9B82
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:x64 arch:x86 arch:arm64

Commodity Android RAT builder stub artifacts

Contains namespace or class-naming artifacts emitted by off-the-shelf Android RAT builders. These kits generate a fixed package skeleton per campaign, so the stub markers persist across operators and configurations even though the C2 and payload settings differ.

rat spyware trojan
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

da94bce1ccb57f50e57a7fcc3c5d5f68b18572abf362171a92db50f387454982

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,OU=Android,O=Unknown,L=Unknown,ST=Unknown,C=US

com.etrim75_modem

Android Permissions

7bb9d049ebd45bfc84e68d03db315f003d040af4a3856315ca75c5166a34503e.apk

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SCHEDULE_EXACT_ALARM

android.permission.QUERY_ALL_PACKAGES

android.permission.INTERNET