Analysis
-
max time kernel
45s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20-01-2024 22:01
General
-
Target
dd397384d66ed4fc68204dea467006a73d2e58c5b0c514a0d80d0fcc589bf282.apk
-
Size
1.2MB
-
MD5
46e17803ceda35d70a8a6188db14d9f4
-
SHA1
1ee1bd3028ef181abb541fe43b854964d3c81a10
-
SHA256
dd397384d66ed4fc68204dea467006a73d2e58c5b0c514a0d80d0fcc589bf282
-
SHA512
5152b146e36b549e50a6f832af1bc91cbabee38ae282648dfbbd62f6913a3931014b8f6bd0513989c21bcb041e5f38034d8c04fbc05a73d7adb7d888e27132c1
-
SSDEEP
24576:bcCIPUBS1Hagj9KEgNzOrKschyZopu8+ESELgSZe:ICIMY1HaggEgNzVz9gVELgSM
Malware Config
Extracted
hook
http://93.123.39.77:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD52bb1f5389862149ed4dabaf55638e99d
SHA1af3ae138a08ac14c959fc989ef392482fa465725
SHA256b6881de1eeadaf2297fc578e1aa07e775319334b6f7198f2cbba7e223a371b67
SHA512a1e08700871d56eb4dd16185eb9a91d47ff2266b73bf12363ff79d51e013760ef04505897781777b69f8043f29b35cac104f8f248aeb6cab5a53d4c1d0c89861
-
Filesize
16KB
MD5552e2b068b86098c9f42c9b1fab08edf
SHA1514d92b10bb1d176ca97e4a6944dbf3d54545488
SHA2565a46b663a6ea812100133faa75b26575d160da21bc44f20f8366c6c5d95a2ea4
SHA512e9c93eeaf7a3e139069d68fc1565e5381f9495c8e43bda9b10c25fa813590bd128a2a3ad962458aceeff037856873596d72ddd5d5c2908f78b8294b7b2433fe6
-
Filesize
173KB
MD51528840c5f92eb578ca35e7ce457acf2
SHA13df2f8a46f8573e3bb89e5077818e70cb6f49f98
SHA2566706354f7a12aa71bc69791b5f851d34b0ab9f77d8b1358e69cb63e89fd66559
SHA512ca6a09cdd23099f8eda9dcd26478b16a83b1525983928865691b0fdac8eb79584349053f921935705d5108dad5b252c63b1aadf6a4c0be7d8dee249a563e09a1