Analysis
-
max time kernel
148s -
max time network
154s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
25-01-2024 22:00
General
-
Target
e21d0d9aaf5fe3e192d0c59d5fe3f6f551df50e71d8f646f84e71332a401969b.apk
-
Size
1.3MB
-
MD5
9950cff3b4996b8f7d985bf734fb6a50
-
SHA1
52c6f715fdeebd8752ca062536d34915079a8416
-
SHA256
e21d0d9aaf5fe3e192d0c59d5fe3f6f551df50e71d8f646f84e71332a401969b
-
SHA512
0d86659fa302fbf5a7bee1fa16acea3fbfb09d9a53986a5fd24fbb6da5c9cad41f3bd07e5333ccd1f7eb80e5807b981d6464cfaab38fc022d6463ea29ee71201
-
SSDEEP
24576:C2g/E0RsO5cGbpdNUcvTwJnCOe3wvHpp74crQr9l928supwymFdtahCF6Qr0XGkt:Dg/FJhTqwwvrtr8l928supwZdkhCqX5t
Malware Config
Extracted
hook
http://198.186.130.12:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5aeea67a2e6e3ac1fd6a4c14ebdc79d31
SHA1e125d145d7e30b03a51e16955b2c529be54ed80b
SHA2568882d6b3c71b21c4af961853e651df37cbf1cc08648c6ec5cdc55c25631b3fa1
SHA5121055635595e5d0bb24b0d341be730579e74c113cb631afe88dcc28c0fe500a351387ce303ae97319b2b0c1218ba7c3f2c94b138bdfa4af616c42fd0cdb5b43aa
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD55b7586c7eeb0575b641abad288bc52b2
SHA14346aafe147746ec70a12ef6859a19c110a7c2aa
SHA256d33a574e57f49e30518995fbcc0d5b11db74768df23f234e23ae9fb1a922dd14
SHA512b9920b697c08edbb198c4714aa7ff9be6c9e149c8a82925ef57534cfb30754209d2a3919a18078abc9829b7e9a8eddef1e74710f3505af87a533a394d45925c9
-
Filesize
108KB
MD5e4b358bab9fbd2f3c8078f3225443fee
SHA11ca1f45e06576520016140b73a31b29e73c983a0
SHA256d53ba29e457a97a9af59c4a8ef5523787b4a5617f3fe5c28ee9035dd9ca369fc
SHA51260fc338152f3890d3352f31e3df9e229c4629bc9b124824945ca061d989d53f51f1fab99558e58388c800311ddf1c4d10a5a073a1c95033b49da806df9af7d6e
-
Filesize
148KB
MD511c51d465b0491ce17c3cfe227910434
SHA18a447c2ea4cba3df28934007756f6ee3ed8a2244
SHA2568f6d7ec158cbfc62a6f950c2e16737acd904a491d6c7e51bc4132dffac084e9e
SHA5120f2c59c274502fbf759bfbbd36f11bcd368feebdbcc9afb41fd8e9d521f4a3300a1c2dadd6d887f86222605aa62926427ccfb0a4bcaad40007d33d3de4488335