ba31c710ee71e3ae4491afca356c0bcb0cd240aa1da793425c87ff36603303d1

General

Target
ELISIUMcrack.apk
Size 13.6MB
Sample261023-rbttraet5n
SHA256 ba31c710ee71e3ae4491afca356c0bcb0cd240aa1da793425c87ff36603303d1
MD5 b8d5724015bcf08814403860c7560f20
SHA1 d22fed98342ced717f0eace37bbbc61e3f138cdf
SHA512 78a4cdc6c2fb95ffbfa5b5ea3390e62da20aabf086fa89b1caa28d4d9aa7ef4bdc6382440f1d32fdb4c27baa88e46a818994ee3378540049f90166f6bd318c05
SSDEEP 196608:ES+BiksYNMb606q3jWuYupzRT5Si66bGxiAna/Ta/y/es9jzN9BulqbJpT1RbDYM:ESaa7TZ/pt9T7On6a6/LKlO1RbDJ
TLSH
T174E60207FABA1D3AC65F03321AFA33016335A2AB774347876980D9D87C736C9525B19E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	zei.bpt.rnr.irt

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	zei.bpt.rnr.irt

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

zei.bpt.rnr.irt
1⤵
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
PID:3337

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

2

T1632

Code Signing Policy Modification

2

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boost-main.apk

Path /data/data/zei.bpt.rnr.irt/cache/downloads/boost-main.apk
Size 20.9MB
SHA256 ed41eef596df26a9d94c0592f79d9c30759f8a3a68c15977d6eb4f39167c8dfc
MD5 e7859642d7b201ac34b795d70d32df46
SHA1 5c801f198048e1658d6a351443a792cbca853398
SHA512 e4b27b8db46674503fd00c9dfcf0bdef7113b36f720ef88d1581262d5e9acd540b3bcfd74069be1580c982efad49ef19cf60225114bb0d7d151b87c7a96f3ddb
SSDEEP 196608:WdEoj+/D5cDlfkZ5xmMLqw+IFIT1dFTqTLJZqGQL9wKA3OfUDBF/rumL6vfdAA/G:6EMytCUjq+73Of0z32i8hwYh1HQYQIG
TLSH
T19627E167F7A6AD32D75E07B288FE6354B33062C627035B422444D6BCBCE33C4AA952D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.3337.tmp

Path /data/data/zei.bpt.rnr.irt/cache/oat_primary/x86_64/base.3337.tmp
Size 65KB
SHA256 9ff0f59fa7cad0aad1346aec58f04359675cf1c9dd8d9a084e9d51ceaad8e3ef
MD5 15fda9e2ecfa3a4b18635e6509fb0081
SHA1 b373c5e7c6bf3d9767fee08e2881d6622d41d3df
SHA512 036d95364c4e0f81f3bc81731803014041f79d8ac3f03ca78afc84fec171a8ec2bf956c63797b1180bbdf841e9c9545d31af063e74c3c21c3cfa19c6e7b495ec
SSDEEP 1536:X3lAzBYyqXocA5Jl0ip+d62tcMHIkVGMIfVoqJW1wwASm:XVAzTVcOlj+di3kVZ8eZ5Jm
TLSH
T1DF534BDF7E219018C1BDBBFA4C4201E6A965C44171476818F976673EE833F98D7B0BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/zei.bpt.rnr.irt/files/profileInstalled
Size 24B
SHA256 6b47c68d2a0abda86039b129ea5743937a73757b35c30fb3a5d42c70d09b9496
MD5 c8ef1ee65e13c5719a99aac4ab8e8db6
SHA1 1f7e1329e1dae061b2c0739962778eb35a83ee94
SHA512 336cba87ae4ffaf53d83c649d0b475a660b05828604a6bc0bf7f4094a97a2484efa724535f3a1b3a74614b1a379044badd8c113fdd5bdf54262d58aa55bc05fb
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/zei.bpt.rnr.irt/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 f91e27ec6eb75c56878483909756d433bc4e02402596092e991f118f815a6075
MD5 6af076e198af82f67e6945d5a5f5531e
SHA1 1dfd69a1e3defde297ce020fc21ab19942dfeabd
SHA512 70210b640c945e964dd1cf5bc045c1a133a4a575a5f8bf8953f16a34e1739d80eefbd87b7a429ad65ca29b2fda46adad79ad6ac69188bac05118e07791ecf4d8
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/zei.bpt.rnr.irt/primary.prof
Size 271B
SHA256 67da07c4227c73576dd888eddb2e4fb1947ad565c95a755dd5972e22c710bf98
MD5 9481c3c25739448dcbfde67f8dc4d7e9
SHA1 786c3ad7a1ded675d6c092634461e3aaeacbb0b4
SHA512 5aa17e6716ebf0adadec18c1172aef61d1420af832f3cd09dcae75b9ee31f9f71b074429e9584b2a28c864221029eca5cb475a1da0b09b014e1e8e21cf36515c
TLSH
T114D0A71885DC3544D55B3EF4E27A86335069ED6C16AC02913384F182043374AD0E789F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads