Analysis

  • max time kernel
    3789833s
  • max time network
    38s
  • platform
    android_x64
  • resource
    android-x64-20230621-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230621-enlocale:en-usos:android-10-x64system
  • submitted
    22-06-2023 06:56

General

  • Target

    849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5.apk

  • Size

    2.9MB

  • MD5

    24d1aff4e64ab4975046256cd84f364a

  • SHA1

    87eb2a30eeb048e1a061a4c0c1694284ab0e5f79

  • SHA256

    849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5

  • SHA512

    8e525f2cb247d73da8e4010e90b9bfac39dccff66a22fd56c893a867bc3aff0c8c937c6fa073c52965a76de3786638503a42ccba97a5c07d463e9f5928d43d3d

  • SSDEEP

    49152:3mg6ICINcBQ4nCnzvMSjjajduVSWrqd/+kog2AsjwPVTxVhApUfmL:3mTDJatkP+dvjw99r3fe

Malware Config

Extracted

Family

hook

C2

http://91.215.85.22:3434

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

Processes

  • com.dekezumepome.deyecite
    1⤵
    • Loads dropped Dex/Jar
    PID:5152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json

    Filesize

    705KB

    MD5

    21672f1a63abf2641d367d27ae8a2ef3

    SHA1

    4d402ab52e8c987bf876a0b8a2e24112032bcc1b

    SHA256

    e71046d6e6c9657a27f483c55c84762daa544f36d2a98acd118d1ffdcf9fffb5

    SHA512

    945c9ec8627e657e15eacf4fc804b8ece90fafee5ac5d3611e82e9e2629f4c8d7476bcf3723747812301ef19ab366e10be1b669074e17226c713dc5b56c4988c

  • /data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json

    Filesize

    1.5MB

    MD5

    3e37214a8dcb0a66ac8c147b7ab1c0e4

    SHA1

    9c777385a33bd871dc1d044985b44e673a7a9633

    SHA256

    8e64678e1b935f9c316d939ba016a1aa6e7b603432ba3b5326c329a2e089ce83

    SHA512

    877a7ea90ee28e0a293c9ba9996bca8c2f667784436e5ef8ac73486041e5e58331a29e293476359142ab5d74896704d59f543d18ae4aa4db1ddf0170f13e9ae7

  • /data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/oat/CHw.json.cur.prof

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb

    Filesize

    8KB

    MD5

    b6ca8b30661a7844ed292db75a29a953

    SHA1

    8e0d397ab1f2ced1f143829084c3f53333743bdd

    SHA256

    63a219c7092be26641907c5f955aa977e7675e3922a8e4ee2af25bfed8c7bbfb

    SHA512

    d21ce3adf13d61369708ea000438f626973f20b08ca05a744c1cccb2d5e7c264a8af9c3ebd18a7a6a464d38e1c64146f8e881d29d71a0484dd94212315f6dceb

  • /data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-journal

    Filesize

    1KB

    MD5

    d9abf11980fcae6cbb77859abd9e513f

    SHA1

    6ac56f8a23d1dda83511f87d04fdfa736306e41f

    SHA256

    ecffbcc58e5163ad6ee177b067aca82e540fcfa2a3fb159f0b3464bf96743151

    SHA512

    caeba36a0f849f956c07a13fc2de627116535013e1f8e89ea7f89d94db01eca69db40f69463a1fdd07460c06bdc83e58b4e0e97b2c49040d97a4a83a4542ba72

  • /data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-shm

    Filesize

    16B

    MD5

    4ae71336e44bf9bf79d2752e234818a5

    SHA1

    e129f27c5103bc5cc44bcdf0a15e160d445066ff

    SHA256

    374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb

    SHA512

    0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

  • /data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-wal

    Filesize

    346KB

    MD5

    952667380eb3f89680dcd64c96ffce8d

    SHA1

    874c39bba00462a54029726f019f66f00b4eea18

    SHA256

    362742b500ba6f3262cedec90ed83a86afe380fc557bb84509d7dfebe1963b64

    SHA512

    6f74dec6cc7716cb8a88e5cc961c91d6657301e68f30dbf07894db718ae02c37dda481173713586808343504eb63300835e62df78e3807d8e9273d23d0521a9a

  • /data/user/0/com.dekezumepome.deyecite/shared_prefs/settings.xml

    Filesize

    138B

    MD5

    f8bdc04912eb3db8c209c12532aa4591

    SHA1

    02a8902131d9156b4ec30974580ad083b7d52a84

    SHA256

    b975dd690c4028dba6fbf2faf0e940d46ea0dc458acbc24eafe74e9d5b75d19a

    SHA512

    08aa271eb341ba240b088f2209c387d3f8796956a6220ddab34824e251fc33c691db70144710146a9e05675e7354d1b070727d4a76aa3f88b71aad233ebb1101