Analysis
-
max time kernel
76s -
max time network
137s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
09-02-2024 08:56
General
-
Target
4e4095098376a1f4d6fda6a5047519a252d27853a3cf4def5c6e731a21592cdb.apk
-
Size
1.1MB
-
MD5
5cfd5c4c94f7ddede2ef937bbe5d7722
-
SHA1
60d7e235c38c205d377d7d2e477a981c0629a221
-
SHA256
4e4095098376a1f4d6fda6a5047519a252d27853a3cf4def5c6e731a21592cdb
-
SHA512
f1cc7759849cbf300d885ae618f4771cf65af5ee34396fd831c62179c5a814f6acee73de39e0a26f075083b63a8660d713a18c5ab53781dad03eaa74a8ddbf38
-
SSDEEP
24576:KW4GI8JXs+C85Vv6S6pKZTY//db/C+/IBwjojy/2Pg/+e95:KgFXsX85Vv6S6pcTY/1jC+YwjXOPg/z5
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51ef3c7f4b1a696e6d1a90f54229a89bf
SHA160c4965232082a9a0429c448fdbd9c0dae1c9efe
SHA2565edf3b0eeea61ef3fc9ce6fae078dfee19b0d339b0629eef31af13dd0229d808
SHA512fbd3cf9f40f6a8503279e31a8f5a86b3a278177ec24fc2b85938d438a123331e25cbb1f40fd54081b40c6bbc63001f587868579cb8a171af7611cc6f7c41087a
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD5a0bfb94db36502337a42486b42a4d1af
SHA1c4d6b551ffd2b3776087a9f753cf082334faa62b
SHA2562355dd235678f4783407e621a1cabbd7a251900ccecfae8ef606d9de33026aff
SHA512ffe0d9e2436e99eaaaa6c5e4e824390a64bacf0e32cfbb4b123261bd3e6d08302fcec6c92911572c23ad3cb6592879ff7a502c46abda7817c964f1476f1bead7
-
Filesize
108KB
MD53381dbb88b064cdfd589dd01e3aa841c
SHA16a39176d2f0055921e7c8cb60bd1243fc5c9cfaf
SHA256bab7469da1fe2ee73a117f8363eb0f44854da1e4d25bd7923b37f9fcaa64a344
SHA5121401b65a169fcf4d53d7ae5731760a274753f00303270a2b83dd593747dedc3bc62df683891a5667d011391f77031b5a246b8f4046d66385f9af29fb9583a8bd
-
Filesize
173KB
MD5e4b4e8993f7346576af31dca8c31cdb2
SHA1f8db5dac901cbfc41bdb1795d760480bef9854c5
SHA256da3f4ef19ab2eba5f12a508155afa37f9d5472f9456744c8f2141f99fb702383
SHA5128d90418fa1074c4fbfc480882f70a154f143b79fcf1a98a5e10d3b239e968358b007dc556d30127217612298f47c77f2c8c02228c454753a07fba3bbe9004a6b