btmobrat | 07cbb93d71ecb3892ae8dd9260efacd11d6848d0397ea9c4ed7efcf87581d691

General

Target
jaffacakes118_07cbb93d71ecb3892ae8dd9260efacd11d6848d0397ea9c4ed7efcf87581d691.bin
Size 29.9MB
Sample260910-znrh6agp2x
SHA256 07cbb93d71ecb3892ae8dd9260efacd11d6848d0397ea9c4ed7efcf87581d691
MD5 f09ce8aba8f2428892f825b116066814
SHA1 5f27c8ae2d9919b347c9db6ef102dfb18e050741
SHA512 64f41b71faca86543cf0742223ab415307fbbddd7cdf585547ebda0f34abc08f7e3c4567ae871e6f6b73d7918c4d5d90984e9d2c4b157f7266cd2402ffa3b155
SSDEEP 786432:sbc7mcgzvC+sf+AtqhEf8s9rNaFN5fBrXol/:Gc7Q+XW68s9rYFH5ch
TLSH
T17367F189ECC2EE32D4A656BF0404C5B1F22F0E2EAAD747451302BE3E347619AE365D57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_07cbb93d71ecb3892ae8dd9260efacd11d6848d0397ea9c4ed7efcf87581d691.bin
- Size 29.9MB
- SHA256 07cbb93d71ecb3892ae8dd9260efacd11d6848d0397ea9c4ed7efcf87581d691
- MD5 f09ce8aba8f2428892f825b116066814
- SHA1 5f27c8ae2d9919b347c9db6ef102dfb18e050741
- SHA512 64f41b71faca86543cf0742223ab415307fbbddd7cdf585547ebda0f34abc08f7e3c4567ae871e6f6b73d7918c4d5d90984e9d2c4b157f7266cd2402ffa3b155
- SSDEEP 786432:sbc7mcgzvC+sf+AtqhEf8s9rNaFN5fBrXol/:Gc7Q+XW68s9rYFH5ch
- TLSH
  T17367F189ECC2EE32D4A656BF0404C5B1F22F0E2EAAD747451302BE3E347619AE365D57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
behavioral1
- Target
  1_ed07ab5c0d.mkv
- Size 32.8MB
- SHA256 acfeac90095c39fd621111731467978f910b7d00da896cb07b0e7cfcb11bffd2
- MD5 08259144e31f1ef27158ef1d885bf1fe
- SHA1 136170bf200a17ffe81dd8dd7020b8a11fa6bfb2
- SHA512 767c923fcbb766edc46601628a7eb122795ff17d34165c91d57a7b94a79cf93b27833fc99b7417cd22c4b8fc2920ed3c407b202bafafaddec15f96c6bf0fdd53
- SSDEEP 786432:06sw4C5D+0FXpDcp8YA+EGRs4jsKN3K1jV0gCMhQAv35yECoXwMa2wWCQD70pK0:iE+Wr70K0
- TLSH
  T1F277D00DFD89DE23D9D6507A08458BBAB3172CA487D2C3821701BA3CB877BD46FD5A91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion btmobrat impact infostealer persistence rat trojan
- BTMOB RAT payload
- Family: BTMOBRAT
  BTMOB RAT is an Android malware that is based on SpySolr with RAT capabilities.
  trojan infostealer rat btmobrat
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral2