Analysis
-
max time kernel
150s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
08-02-2024 22:15
General
-
Target
2bd1641352c96b21dfa61088b708c907dd6b57e5ba919b6bb3a7c6bf649dc66b.apk
-
Size
1.2MB
-
MD5
ad5e53c3c1a9d830e4d5074a23b1ca7f
-
SHA1
138458bc2cf96c813f2ff108d8ceb2a9cbc18e3b
-
SHA256
2bd1641352c96b21dfa61088b708c907dd6b57e5ba919b6bb3a7c6bf649dc66b
-
SHA512
cf1abb7b240258b0c54f84c56d491cfec68fd75152dad4821b162ec04f4fb2d590beb1f9833c4f5327e7bb8e0763b38116282d068a6fe917c7ce64b57cdfa8ba
-
SSDEEP
24576:xj6ShpuJkeC0iOSqUPY25MA6K8aFU8RcGikBkwG4ugoCQpgS9ZL:jpu3qOVUHMA/8aFU6cd3QQpgSv
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD53ebab037b7ce398623e7aff55f9af93f
SHA11b42cb92a946a12efe8750a78870289b07b68761
SHA25638c6484b17387708407aba7db26af16eaeb6ea2ac31a0ef7baad6e63aa4eda34
SHA512418c5ada6227580d020892fa0efb82a7b9dcd4138656bcbf580f5fc0a384cc67b19f0852e9756d8694f92ee0c6d632a5024e37a0f81910156777570b1ae45ac3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD529de1b831244cb0121f8f780f92d3dd9
SHA1e0bac008ba2b485cb30b65fbf7408ed316f78d46
SHA2568cf44d2cf916d95a68387148f39144e9fd53fcd44f1febf667918c0aeeb7425c
SHA5125295648fc19c60f2858c4a671bb68cd3e82621437cf58ff8cd02607b2c37f62a68abbdbf7b4e9e9f9fefdbb69a10045adf97a89eb4de5cb48f404aac583dce18
-
Filesize
108KB
MD545cb165310398ad4e9fabadfaa4a5f5b
SHA1213404eae8de4b96a2bca433adf2aa2c9978c2a8
SHA256976bb3d8fdbf620e672f169bc4fdbc780f23fb29efc710c66ca9383a861e1a42
SHA512c54743b6e73c9d83ecaebd95091592a7f78762f29b3165bce2324b11d7f4fddea63f2f72ec86c06e91e50bac42619c4d6d0d555c0ddd80d26246f45317aa1135
-
Filesize
173KB
MD5dd3f6565ecea79626dc933fd56f6de9d
SHA138a52e4259b30088b60de6534a7c5bdfd2641a96
SHA256bb469b9879df0c9b4cf47f345d8502bcf25e02e1764d55754e8f409265c44c92
SHA5123b9c0f9bed57ca058395befdfb1b784c07156e301aa802226da6167e08fe6da156da0bfb7f59ba1de977ace0b9bb363ee80f96f2f006430bb933648f620f4fd0