Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    24-01-2024 22:01

General

  • Target

    5084b7d04053dee696cf2c0774b9ce2862fc52d94cb91a817e6e2519199a61d5.apk

  • Size

    1.1MB

  • MD5

    fdf405da2e5ea9d17bbd80c7135ff126

  • SHA1

    88df35260863316572f7c1f4954715153e3b572d

  • SHA256

    5084b7d04053dee696cf2c0774b9ce2862fc52d94cb91a817e6e2519199a61d5

  • SHA512

    94e581eb2d9d09ad5d228218559f8fa8e2e2831f1998887fe242fa341777e5bb25fd5446836d4e4c54b25b6b2ca8c2d4dea5aad9c47d726246141f750c97ce57

  • SSDEEP

    24576:h0gZareG8LKsstERHb1E8hsCDxRkpT2OU/o6yeng/8vpL:FMrH8W5texE85eT2z/Ceng/qL

Malware Config

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.

Processes

  • com.wapotijafobi.jano
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:4998

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    01098b8a99b456b4f6c05e4a48395401

    SHA1

    3bee81bdc68b776c6f0d85901ca628ddd5062f5d

    SHA256

    6d353eaf7af3780646f1a119da1c4fbee2af23b138f993c87b76d87d907812d6

    SHA512

    c5cba946bd66590c53242b06502b40f7e83044a72e60c54214c8590d24fba678a4d0bdf6b256acd698fffe22f3ed84e659cf1076ee717d63a5997e3d81929529

  • /data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-wal

    Filesize

    8KB

    MD5

    3530254b3e5ee2149ade36f88a7994a2

    SHA1

    ee21559a6f1d977f33a1c82e85ff5654b50bfeb7

    SHA256

    709467fc928bff3c5369916b2b663dcabe3c653d9aea7c398fa77560926a9e9d

    SHA512

    15639c32dfb5e33e313fe5387e579ebbc912a92175d71fe96b240f021d02cf888c8639bb4527a1688286ee8fb2317fbfcaf6bfcfddc7b204e00eab5632b9812f

  • /data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    ea11b886c7c7fd61b4c622205ea15608

    SHA1

    dd521a308de1f5aa237d4dae7aa24e2afe4c8b3b

    SHA256

    1c651fdbec68781d61d821750353b3c035ffaa197cc66dfd28ea4450bc144c60

    SHA512

    9558a8e9dc8c80c2ae97b4e5f238ddcbb34203178720fd259d9ab8418bfd6eabc426edc915bc382df964c55d19b62b21cedcab768712a9f5b1654996123ce2db