Analysis
-
max time kernel
151s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
25-01-2024 22:00
General
-
Target
e21d0d9aaf5fe3e192d0c59d5fe3f6f551df50e71d8f646f84e71332a401969b.apk
-
Size
1.3MB
-
MD5
9950cff3b4996b8f7d985bf734fb6a50
-
SHA1
52c6f715fdeebd8752ca062536d34915079a8416
-
SHA256
e21d0d9aaf5fe3e192d0c59d5fe3f6f551df50e71d8f646f84e71332a401969b
-
SHA512
0d86659fa302fbf5a7bee1fa16acea3fbfb09d9a53986a5fd24fbb6da5c9cad41f3bd07e5333ccd1f7eb80e5807b981d6464cfaab38fc022d6463ea29ee71201
-
SSDEEP
24576:C2g/E0RsO5cGbpdNUcvTwJnCOe3wvHpp74crQr9l928supwymFdtahCF6Qr0XGkt:Dg/FJhTqwwvrtr8l928supwZdkhCqX5t
Malware Config
Extracted
hook
http://198.186.130.12:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD522d39ee2a579fc266ee5a13113bf920d
SHA12eceaedb3f5ffaa0b1c566e440fb33ed1351790d
SHA256a54b1553ba8733e6d9d4be5396cdb40baab43d2242ea8eb45c35053407d661ea
SHA51291c82ebf52549491fca5d51df08a02962029511ca244de4336feb12e8522dac9208778008944af0ecfc423e6ecde254cd79beb7708dbf6658a4a8fe002154fa4
-
Filesize
16KB
MD5c625ba536d987005e42e3f28529a8ba4
SHA1f60527d8b4da54841f62a6692a4ed78c1cb9f8b6
SHA256fcdde1eda15344b017e4bb4c5863b771f8dcb747f083d5f39d06007d5806bce0
SHA512b3188e8eb086800aacdc3c40e89a6fc3b867f530221e5e9275df2ffa31f878a71fd8450f74b0ea3277bb4b03ff4bae9b7e3fa5e49351d9711cdcd372cb333ca7
-
Filesize
108KB
MD595643bdad597d33ca69ebe5cf6efa21a
SHA15c08d186c6a536c80c996c8dca7ad9c2f0f114cb
SHA2565dd9ae33ef164526262da89c7750f9d4462a7318ac42746c399e0d2618b6b421
SHA5120f78bc6e3582b4d619f734738f609870c1ba1c187c3820072623e985c0c158a552ce4ba218433663c4b3f66e8d05bf2856c812ba8ce3510230f6ec40bec2ca02
-
Filesize
148KB
MD5c63c1518ac754ae8c5f9a45114a7235b
SHA1aacb0af499d94126978bb078bad02aa26e6a982f
SHA256270f1512004f06cccf7981d871d2415e9abf51af83cfa0e79575af42793a8ed7
SHA5126d48a15d92d4f7ef36c2377a5f34bbc6ed7520625967f3bc958f29a9235f9054949b0973580757ade336560199d349998391fb4daa8a2ef0fe2da12f7cd79827