Resubmissions

08-09-2023 03:26

230908-dzpm2sgc54 10

01-08-2023 11:42

230801-nvdp4agf6v 10

01-08-2023 11:24

230801-nhn1asge81 10

General

  • Target

    Lol.apk

  • Size

    3.7MB

  • Sample

    230801-nvdp4agf6v

  • MD5

    10f5a518febd8b0b08b7f69982bc0a7d

  • SHA1

    77137ca4881b82a9baf3dea99e03ce92c89cc742

  • SHA256

    238cdfbab88cbcb6b1a2379b2a18c993640c1f498c4cb0e9faef408331f41c0b

  • SHA512

    52c557425b2eff4f244c2c34280118e913574c0b3a51bff966c4fb4538afdc1220ad6f94956098aeb53cee4984aeff30142f148f6e19c1a978af6d0e7801f918

  • SSDEEP

    98304:z/Se3GAtk9/CYItyoKmFTwgzOOH2qWS9Rr:+e33tcPItTvFcg5W6b

Malware Config

Extracted

Family

hook

C2

http://193.233.196.2:3434

Extracted

Family

hook

C2

http://193.233.196.2:3434

AES_key

Targets

    • Target

      Lol.apk

    • Size

      3.7MB

    • MD5

      10f5a518febd8b0b08b7f69982bc0a7d

    • SHA1

      77137ca4881b82a9baf3dea99e03ce92c89cc742

    • SHA256

      238cdfbab88cbcb6b1a2379b2a18c993640c1f498c4cb0e9faef408331f41c0b

    • SHA512

      52c557425b2eff4f244c2c34280118e913574c0b3a51bff966c4fb4538afdc1220ad6f94956098aeb53cee4984aeff30142f148f6e19c1a978af6d0e7801f918

    • SSDEEP

      98304:z/Se3GAtk9/CYItyoKmFTwgzOOH2qWS9Rr:+e33tcPItTvFcg5W6b

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks