MALICIOUS — 129_AndroRat_6Dec2013.bin

MALICIOUS — 129_AndroRat_6Dec2013.bin is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100), attributed to the MonitoringTool family. 2 of 52 detection engines flagged it.

Identification

• SHA-256: cdc56dafc18a774586e34185d46d5768c68c587c86656f6ff82cd85ff6290dd1
• SHA-1: 916ee709c48d1416c69dd17c2ad34640b1633634
• MD5: 90b3f171d485a2bbf7ac5fc9430faf3d
• ssdeep: 192:2P9axlmEA3vVFVU8fNBCb2nCCjDWZ9gdQxPpN2tg5824U8D:2PGy3vbCmKZ1HtjP8D
• TLSH: T15D2384F59DA9020BC2B5560CCC22C6CD950CA1F64E79A7D9C96C4DA6A433F33046693E
• Submitted as: 129_AndroRat_6Dec2013.bin
• File type: macho · Size: 10851 bytes
• Verdict: malicious (72/100) · Family: MonitoringTool

Detections (2 of 52 engines)

• Microsoft Defender: MonitoringTool:AndroidOS/AndroRat!rfn
• Emsisoft (Emergency Kit): Java.Trojan.GenericGB.24463

Why this verdict

The malicious score of 72/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged MonitoringTool:AndroidOS/AndroRat!rfn (rule MonitoringTool:AndroidOS/AndroRat!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Java.Trojan.GenericGB.24463 (rule Java.Trojan.GenericGB.24463) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More MonitoringTool samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report