General

  • Target

    af19050f00acd13574451cc16e587cac.apk

  • Size

    1.1MB

  • Sample

    231112-qh2bqsgb3v

  • MD5

    af19050f00acd13574451cc16e587cac

  • SHA1

    f3540be84bbdda033c564f30c8fb8cd7a25578b5

  • SHA256

    362d9b6948b901b263738736f0482706df81ec0c3eb354d79d75a1cb20c0b77f

  • SHA512

    e1a48f014ab9636ba77e56742b1a1c884b9272b34a2af0d37cee11aa63ab75f098effa01607f3264a7cf43e255b670f21da939c19c3c65f9ca8ad307aff57eb1

  • SSDEEP

    24576:18HQh8D2S7ML127PRohZWgdJW+AGuTp/ojDgpg/nKKf:18HM18PChEgdJRAP/2gpg/Pf

Malware Config

Extracted

Family

hook

C2

http://192.168.163.136:3434

AES_key

Targets

    • Target

      af19050f00acd13574451cc16e587cac.apk

    • Size

      1.1MB

    • MD5

      af19050f00acd13574451cc16e587cac

    • SHA1

      f3540be84bbdda033c564f30c8fb8cd7a25578b5

    • SHA256

      362d9b6948b901b263738736f0482706df81ec0c3eb354d79d75a1cb20c0b77f

    • SHA512

      e1a48f014ab9636ba77e56742b1a1c884b9272b34a2af0d37cee11aa63ab75f098effa01607f3264a7cf43e255b670f21da939c19c3c65f9ca8ad307aff57eb1

    • SSDEEP

      24576:18HQh8D2S7ML127PRohZWgdJW+AGuTp/ojDgpg/nKKf:18HM18PChEgdJRAP/2gpg/Pf

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

    • Makes use of the framework's Accessibility service.

    • Removes its main activity from the application launcher

    • Acquires the wake lock.

    • Requests enabling of the accessibility settings.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks