Resubmissions
10-12-2023 02:58
231210-df9h4sbfhj 1010-12-2023 02:27
231210-cxrtysdbd5 1004-12-2023 23:54
231204-3x1pzagc3y 10Analysis
-
max time kernel
1368300s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20231023.1-en -
resource tags
-
submitted
10-12-2023 02:27
General
-
Target
d0f6fb23c8d44e145fd53b49aadae882210988562bc50dd4050eb2f299867fa2.apk
-
Size
2.8MB
-
MD5
d54f97bdf040848bb4c81bc31d1c555c
-
SHA1
f65d0f596ea70b36d5b60dcdd5ebe0ba79c749ce
-
SHA256
d0f6fb23c8d44e145fd53b49aadae882210988562bc50dd4050eb2f299867fa2
-
SHA512
a82e77de72e5bad481dd353f6a1c4646254ce1fcbbe00db7d3f6a48b7fede69be494a1d79445909a9ed48abd66bab49580c10e52efb12b0bb8b4c9f10e526d7b
-
SSDEEP
49152:PCaTT4jHJEeu4+jXhJRt4OQpznwVAkGNA5VsZcYchULdzF/Xx3g/Fz:/T4dcZNJRt4npTwKkGNyJ2LdzFXCz
Malware Config
Extracted
hook
http://195.35.11.135:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD501eb32852a399af8a40d3eef9b474589
SHA15902f9946e660c3a7282cb9c9655725fcd3d1c09
SHA256d7941cf71b94e47fb1cba4eff81a31459a0c607d6660bd33af96d3cbbd3eac16
SHA5126b849f34f3e977ce13f0dba404080e75019d37bbab778a16bec6b6e2b676e62b3566e261f78fa09a8de801c81df0c29ec81f376681fba9fdad743fbbe2b0be98
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD57509876922633a5fb77fd54c2a812c97
SHA19b231c53b08cb2d72dc7ec60a21edf1d3a0a00a4
SHA25688489d6ae333125b7527916bdac6ee877424c026588f98d081c1a7448ac2803c
SHA512d552927897564d966e02a7971a1237d262d46b0409dd6c4f69237467e630b24417c5efe6a1b74878b7898aef0f2cbe236a4da781b10e197056b75f8aa962d208
-
Filesize
108KB
MD573dd650ea191c889730c61aa388f8eaf
SHA14e7831a7f45755c85bcd93ca271ed59684298eaa
SHA25616bed920916176f1da6cfa9161fde82a919e6e19c13c2fcb48ee0ad46777feca
SHA512ced7b3e141865da2e5ee440606c8908565169868aed42297df7dc855001e8680c8b3c68c78ae3878cb8800a8f2fe0098500382e78828137a1ffebab5539fa571
-
Filesize
173KB
MD549cf9196c2d5fe6991413a80c582951e
SHA157c8d2e1571c07e7cffac4f867078954b6586260
SHA256d8f2a6a7c9a52674555a8363c31a40942474e2d6d290701f4687cd2b40818abc
SHA5122122befcfdd8bb2c6cfb139c2c57b80b0eedd295a3835524313325b4e1ec11a306aabd662180490c62409c98fdc5611c0acab5e55d42a4050546c31846b02f2a