Analysis
-
max time kernel
24s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
25-01-2024 22:00
General
-
Target
e21d0d9aaf5fe3e192d0c59d5fe3f6f551df50e71d8f646f84e71332a401969b.apk
-
Size
1.3MB
-
MD5
9950cff3b4996b8f7d985bf734fb6a50
-
SHA1
52c6f715fdeebd8752ca062536d34915079a8416
-
SHA256
e21d0d9aaf5fe3e192d0c59d5fe3f6f551df50e71d8f646f84e71332a401969b
-
SHA512
0d86659fa302fbf5a7bee1fa16acea3fbfb09d9a53986a5fd24fbb6da5c9cad41f3bd07e5333ccd1f7eb80e5807b981d6464cfaab38fc022d6463ea29ee71201
-
SSDEEP
24576:C2g/E0RsO5cGbpdNUcvTwJnCOe3wvHpp74crQr9l928supwymFdtahCF6Qr0XGkt:Dg/FJhTqwwvrtr8l928supwZdkhCqX5t
Malware Config
Extracted
hook
http://198.186.130.12:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD59044b06d5aa285539c5ad8b8f6b56284
SHA15287232d4f771c0c80501168457ade8469b1c8a6
SHA2569391ac39bbfc6c16876c960d57f0917b29826f8f886cccba60717fb7100d7514
SHA51279bafe489b55794dd96a361a413f390e5e80fb8f3f8b915e386bbdbd4f2f232912dd2d4382c9f5aee43bf4e82a68b10617ef875b89124ed694ef7e039c74eed1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54e35287714c1f5821ac19ee1f2b2826f
SHA1e595c7998de9173c7ebde320ae6e1c9e91de3714
SHA25686e202c1da91aa64a8d17ccf690ef7c8cc69883d4470c532df23f6fb13c0fcc3
SHA5126957069a6c5d3964b620fc5e71b0b1dc5fb568e990c97c84318a8e119458ccd5cd82de9e3e9246ed62bee05e98a0df171ec916b7693c51118b5f26c254596deb
-
Filesize
64KB
MD56a3b3427bf6b49f410e7d892da1e76d0
SHA1c0855747ebf3f308d3954e7f6dd7cc6551ceecc4
SHA256d32c01a1c7d0a43828c7083541fd6e0f8577140e929c2f0520853635dc56ed99
SHA51240e0b9b3cc95cc9af3103a442b1927b506bcf73cec1c6aee8423601f11896f3a38a874d76b6cb8b38467b3b4f3d5eabf59be02048c63f7c5d7afc5cdbf8d1a83
-
Filesize
173KB
MD55e725dcde544127b1b5ccd86296e2b5d
SHA182e81366e091111ebc422ea0d134fb3b93f57e9d
SHA256396f8b507ed9a670ccc2c286448601b1ddf3a5a274301c052a1e52f873347d24
SHA5125e9e76dac19a4b956d106ae9ff0a2d3a62b1d1c155ba0d6165430a21ce63e03642b06c28117a4a3d50a059257da49f4bcfd439e051dd1b11b2077c4ad41eeadd