btmobrat | c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43

General

Target
jaffacakes118_c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43.bin
Size 29.8MB
Sample260910-xdjdpavama
SHA256 c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43
MD5 4d3c0f1b8efef255d239834e2af4de12
SHA1 bdfe9f82efdb2d7c3bff01a2f9f976061aa9a4d5
SHA512 be35798df28e8216b42752b34216c08be02688a65bdeb39ad737d6c7f0d51fea2812cfb9910c8c615c82a2ad761af908d72bca0a64c4ebecbf64074ab8705bb5
SSDEEP 393216:qDuF7Hwj3Uoe2H7OfglzBJmlB2Jrps8xDF56trxSXKMIRLcnsFfaN:qDKsTUoe2CuBJmD2Jletx5JpFyN
TLSH
T11067F129DCC0EE31D0F604FF0514C5B2A22A0D5DAEEF87825712BF3E24775DAA761986
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43.bin
- Size 29.8MB
- SHA256 c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43
- MD5 4d3c0f1b8efef255d239834e2af4de12
- SHA1 bdfe9f82efdb2d7c3bff01a2f9f976061aa9a4d5
- SHA512 be35798df28e8216b42752b34216c08be02688a65bdeb39ad737d6c7f0d51fea2812cfb9910c8c615c82a2ad761af908d72bca0a64c4ebecbf64074ab8705bb5
- SSDEEP 393216:qDuF7Hwj3Uoe2H7OfglzBJmlB2Jrps8xDF56trxSXKMIRLcnsFfaN:qDKsTUoe2CuBJmD2Jletx5JpFyN
- TLSH
  T11067F129DCC0EE31D0F604FF0514C5B2A22A0D5DAEEF87825712BF3E24775DAA761986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery evasion persistence collection credential_access impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  1_0051db2ffb.mkv
- Size 32.6MB
- SHA256 7d66a1cb39fb6aeb836e9043e3de065e6eee2040184d35b082520d662df7bbba
- MD5 6a09494d3d76de276ae525a7c98c9e9b
- SHA1 b9456e0a1f03d505ef5fc7bd38b6d4a6efb54086
- SHA512 17c472d9a05438023117ce5289f4e14c7ddeac715f18a70ecdcce023f67c7150670e8135cb38be68b65654cb2dce2c4ce2a5e2d06dd0894606873ebee4150ab7
- SSDEEP 786432:c6Izim0FVpDcp8YA+EGRs4jsKN3K1jV0gCMhQAv35yECoXwMa2weCRFLhiplM:Czima+eAF1ClM
- TLSH
  T14977D00DED88ED33DECB907A0C4546F3B22E2C5546D6C3821602BB3DB8776D46B56B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion btmobrat impact infostealer persistence rat trojan
- BTMOB RAT payload
- Family: BTMOBRAT
  BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
  trojan infostealer rat btmobrat
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral4