Analysis
-
max time kernel
42s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
08-02-2024 22:15
General
-
Target
b362840bd046d1bd4632ce0cc5409feea4ef868f1f8f3ef1d6cb726a44b280f2.apk
-
Size
1.1MB
-
MD5
ee65a8788025a0cbda72696c330bf315
-
SHA1
8cd6f2398e3ac34a3ae30d4cbfe56385b10987a2
-
SHA256
b362840bd046d1bd4632ce0cc5409feea4ef868f1f8f3ef1d6cb726a44b280f2
-
SHA512
b570ea1b0ca3a1252e2601532022639efa6efa1ada8885413ef933defaee73ce1cd44651a7fc6ec7086fdbcee47ae566d5e045dbbfef4312351bb015bf6a0f8c
-
SSDEEP
24576:MJwCWpW6tMjahNNIDQpK7GFbwjojyGE2g/hVT2:MJwjtMjahNRlwjXd2g/32
Malware Config
Extracted
hook
http://93.123.39.235:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5304819ac514a3b48513bd626794b85e4
SHA139cfddc844f3a486ea72fd7a61dd30fead56c90b
SHA256de1611d8d68ed2476247a7a0dcb20ca3fb25a88e4c2d88bf5c8db265cca13675
SHA512a2102bc6bf4f52491ef053e805323e4b2e596aa98b116210f1e3a37a393b1c9e9133e3ac5abbfac25e824fd3d97d348a166154baa725bb0ea01964df5cf99b40
-
Filesize
16KB
MD534d993661efe63ccab06123db1a7bf89
SHA12420f0da97e61e30e3411dd224de1983b2708b17
SHA2564d7ca972506cfa638eae4f9a8de0355f5027238949c2523b1f8df456c8f56e90
SHA5126db0c9e386115ebdd8ea75e51b92b8ea787dd57c2cce29e4ffafc0a0d06381531ce64a5123cd61a24ff49b6d0600045c40a21bd6dc529301fbf33cbceaa7652c
-
Filesize
108KB
MD5ba81ac2a897ba8b53a02eb746d48b699
SHA18cc3185a29cc92990935aeabf7ccccd7b46c556d
SHA256ef9137b0bb40811bf0f6cc8b147ec55c7f9a1ea2d35b6df6ce0361e4d7adfee3
SHA512037d6f90a7d6656f3c6ee69757999d3b1329494b84f81e367af3c783582765a17c872d3126c6a65a2fa52a2ca0e76a1a283f0679b96dd889e8f63ad13537ab28
-
Filesize
173KB
MD5ebcf6cf00fd4831d7fdffef4fc2a5add
SHA1d6f86778c0d18a0417db6d64b843c9e49900a389
SHA256742f33b964a0c25e39257e8379ae59db66b6aa88aadbf3f3073096d65b29571e
SHA51265b0da1c89dd4be01994bec9ff75b70a1dbc87bcccac8561468f85eb5c728d1c3a2c948f04910566cc51b593c017fb4c72026f92520e2d1e015cba59a359152a