Analysis
-
max time kernel
42s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
08-02-2024 22:15
General
-
Target
0ef21ffb179d61c9aecb291a8e4c88f023346377b49993465367d2d0aa9beeb5.apk
-
Size
1.2MB
-
MD5
4344abaeb4717d271b826a4acd7dd464
-
SHA1
213390187ecdbc6114ce20af02f1107f50cf5139
-
SHA256
0ef21ffb179d61c9aecb291a8e4c88f023346377b49993465367d2d0aa9beeb5
-
SHA512
3f8aaad32aaee2788d243fb1a51032990b7480b35a31e88f41463f4c7cee896c395febc72b57092614304f8eb9e6aab076166f17c827ffe6a093c53fbce90d6a
-
SSDEEP
24576:/cr/pUPpuzhiXD0zJMc9oP3bz/+SKAFwquTqXmLOMkFhpqHhJgSkv:y2PpohA0VMcG3nKhq1wd4UhJgSW
Malware Config
Extracted
hook
http://93.123.39.235:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5e116a584ec0afd3c586ab24ed895b34c
SHA1827b5b3db369c7513d06014594bc8702608da03f
SHA2568ce5aaaa0ed6448bca179f0139a713be9c90137805df307f11c3192e84508d55
SHA512a7208131f73bf9c329b64ec8248d9be6fef0763b282efefae0af2b5914f250b9944e760f6ef3a33c07213d44208a72eda0980eccfa552c2b233a3f6c47d9686e
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD51269991f2ab61a5ec094c4838f0f7e75
SHA1cbd6bf9817f22e22715aa49e4fa6408370613342
SHA2561529ab1b591da9dd3f70c515d2b24ef10dd7e519b96b3dfd2f40b203e930a48d
SHA512c98d38e427bc7d82b14421e612b764b79a384e74a594369b405b905ee1529b504618b8568db1d87c470d3bbc8f8fb3802b7d400baa8da9a535744b18e8e1c3aa
-
Filesize
108KB
MD569fba7f7835bd183ac4ace4728690dac
SHA17b4506520c9192db00235ac99d0bb6cfd1433c3a
SHA2563b5063325dc7906ae74d19cc22e068da46cea6cc30711a73e01e77b657d14ac7
SHA5121dae29ce14b636e47db208be645f172a3db4c18cad905e4fc621c411149291a8d9e4a3958db30cb2c04586e11ef2c5923813ec681e7e85ae82b31e7934e321ea
-
Filesize
173KB
MD5c7997fbc040dd1f6c870b191743b58e6
SHA1435faaff0d924156b140ecbd892219a176e25e62
SHA25687c43fce79cde03c428b31da28607741d336f24829c8e48f8563146be071d431
SHA51208b9a565a7aeaa2cd7c0138ead78ec1823938b519952683efe7c0f1f87f28c004cc54673838826b7d65332540056cb9ff081afe0e2cf1b908e274c6f93004a66