Resubmissions
10-12-2023 02:58
231210-df9h4sbfhj 1010-12-2023 02:27
231210-cxrtysdbd5 1004-12-2023 23:54
231204-3x1pzagc3y 10Analysis
-
max time kernel
1368377s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20231023-en -
resource tags
-
submitted
10-12-2023 02:27
General
-
Target
d0f6fb23c8d44e145fd53b49aadae882210988562bc50dd4050eb2f299867fa2.apk
-
Size
2.8MB
-
MD5
d54f97bdf040848bb4c81bc31d1c555c
-
SHA1
f65d0f596ea70b36d5b60dcdd5ebe0ba79c749ce
-
SHA256
d0f6fb23c8d44e145fd53b49aadae882210988562bc50dd4050eb2f299867fa2
-
SHA512
a82e77de72e5bad481dd353f6a1c4646254ce1fcbbe00db7d3f6a48b7fede69be494a1d79445909a9ed48abd66bab49580c10e52efb12b0bb8b4c9f10e526d7b
-
SSDEEP
49152:PCaTT4jHJEeu4+jXhJRt4OQpznwVAkGNA5VsZcYchULdzF/Xx3g/Fz:/T4dcZNJRt4npTwKkGNyJ2LdzFXCz
Malware Config
Extracted
hook
http://195.35.11.135:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD58232176aecaa16dd8d43eb3d55112c7d
SHA135bcd0116b62968e7b8a7d4a10186e8bfa7ff8be
SHA25612b2757828532620eb1c1d7fe71ac8ed50794518bab5e54fed67cf3f2c3e0bf6
SHA5126da2d8744b7984d3f6d010b49c358d9276025931bf49e9f9fd9966a0b6060940f1673bd663bdaec9ab9d54f370934103b441d58963f6ac8b5b78be649d49fd34
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD58d57a86c5d4ebaaa3f4414ebe682a6d5
SHA1245752da0b9f4b391f4ea94fce7173b003cca5db
SHA256c6701f0a040c6ffa9c0cc3e51cadc73e62d16cb086ac1d253b10a9cce9e8a7d0
SHA512f1c44eb1bf093b2376affd89582d0b6a3fe8d2c2b6b5c9105e343a039264c65b075a6f227bc5893b14737cbe71f4f82675d7629412cfd7d806cd51864c504afd
-
Filesize
108KB
MD57825a7c8e0dac9a5dc2d983b3a63ea24
SHA142c1197c6148a30aa57490b1b25a6aade6706807
SHA25610166b6621095ae5dc3b3e9b69f35c2a8d5c2581b2b584aee53f1da29deccdab
SHA5121469aa3fffcbbccc6791f2a2586f17334e534d7e51fac6bcba9e1ed5dde7517d2d3b33662423fe03909da20d3f65c8fdcdec8b6a966c8906b7af23ebae645d20
-
Filesize
173KB
MD58e8feecd47484a3f8542cdf876e3e28a
SHA176bf6de73c2cddd75630e22822c0f0982f200ed4
SHA2567a50abb56031f9c8e53483a9ac009733ee1005521e80f3d13ec0fa6200d9bd76
SHA5122f6411b51fdf135ddd336a830e55daa2ad913feeb3b2e8cce411c66dea8437e615a7da4c6367375bd67b50838f8777f1fa1512b15adc080e54b6e982a6c59782