Analysis
-
max time kernel
3124733s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
30-12-2023 10:19
General
-
Target
dc4712f817e553e8371df12013c9ebe027056bdbd2aeb56442b5b46ac71f321d.apk
-
Size
1.2MB
-
MD5
7c466ce81527867aa98ff5f187e54bc4
-
SHA1
e394e2a93af3e746bbd87f2db3ecabf68ee45ba6
-
SHA256
96d9021b3f63da9378e9208b640ebb670906718012db902a400ba101dbdbd3b6
-
SHA512
dc084d7338b41c95b72fbd44c70f2c4dfd3864297eab96d173f58cf3b71d9bff9c068a971686cae8257d560143dd50afac3e1afcd807a5025eacc2631936cbeb
-
SSDEEP
12288:CUZFO7Nq1wryobO83ubYZtsZcoc1IkcxxhtS/7iwbO+yq39DCn0yKLRrp8cWxgii:C6YqL83ublicCy+yq3kn0yIRrp83Gh
Malware Config
Extracted
hook
http://173.254.235.53:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50e8b9fd7888ec4e49ed288297ae88788
SHA185f0c07d9bc64c612adcd416c25f18bbbfcab795
SHA2562d09fad49dc10d6562d68ccfc7332b2f30fbf30cf361f9b665e7c29861264497
SHA51216254a7eb638d08816d14da7ab7cc689978572c1325886a537a4b495561329dcdab3ce73c1e8e3c18bbea5ddf049c4764f746f47745846ed982b8d2e51ade274
-
Filesize
16KB
MD52a0f6513c1d14d9266827f13e2c25ea0
SHA166b99d427c3aa25177f408a0c7300db406e766f0
SHA256f604d1698ba429c3ddcd501fbedff3ae401c3095844bf56937aa4c75c71bdb18
SHA5120a3e67fb577f17fbc35ad018e82c5c5cb9e998556f5c97d7eda888e8c0850b54de8dd9c17f7af6f78c921f3ee6f1a7d3d94edbd544615000386b19e300010090
-
Filesize
108KB
MD52ebb869103a999bebb97f5570a38675a
SHA1521e4fce32af5586dbae4a99cc6b7a7721ecdd92
SHA25612523cedc80f117ca63d09846ab0ec88549bd1bf7b937220a3132e9af013cde6
SHA5124beb6c2312e9e085fb0164a27d8e90621cfb9b7e08638fbd7b6b13a04577297f94f5bc3572346a08aecdafa81adcb19bb5c7acc9bf87f0d37c2a537631575605
-
Filesize
156KB
MD57e5585539aec479b775f3f6d4b8f8f04
SHA10e3d0df1d46b9b8205d9cf0f2a71b2b80a4e6be7
SHA256fd5e63e8f0ab06d9da59f61b97fc30ad5804023fc9b6a3ffb81ac76a0537216a
SHA512371af3a103f0b31464e5de2f2ea9f011a9bcfacb8dea701996b4b6f443941204b19608e3b4d3c1e85254fd958208e0e3743cb76838feaf0be7bf7ed321bdc702