Analysis
-
max time kernel
152s -
max time network
167s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
09-02-2024 08:56
General
-
Target
b362840bd046d1bd4632ce0cc5409feea4ef868f1f8f3ef1d6cb726a44b280f2.apk
-
Size
1.1MB
-
MD5
ee65a8788025a0cbda72696c330bf315
-
SHA1
8cd6f2398e3ac34a3ae30d4cbfe56385b10987a2
-
SHA256
b362840bd046d1bd4632ce0cc5409feea4ef868f1f8f3ef1d6cb726a44b280f2
-
SHA512
b570ea1b0ca3a1252e2601532022639efa6efa1ada8885413ef933defaee73ce1cd44651a7fc6ec7086fdbcee47ae566d5e045dbbfef4312351bb015bf6a0f8c
-
SSDEEP
24576:MJwCWpW6tMjahNNIDQpK7GFbwjojyGE2g/hVT2:MJwjtMjahNRlwjXd2g/32
Malware Config
Extracted
hook
http://93.123.39.235:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD58928d7575575f083dcf6150426a71dd8
SHA1e11b8b31fa4f7606333a6a2a90b7f13c9495145c
SHA2560fdffbe83003c0bbf568f3d9d003d16e6a12659ffb46dff741f2eadccaacb962
SHA51218c8545acdaf747557fb571b32246c35d1617437f6eb5267191ef220414bc320b671c9dab4b41f3ce22422615db5c9e394a485c8ea920733f766a620f7a20fa6
-
Filesize
16KB
MD5990c8f0b75a3edc20bcd473725d403f4
SHA1bd7cc54271eb8e3f7c28cd4888fc653506a27ada
SHA256c704de651c52d1c907b9bf7e5db41e8ba3e5c0d2ebfbcae5e86eccb3607f575b
SHA5125982e1d28181a54f4523ef474e7ee3bed0b0e6076d33db68c9e79cd20f23263cf686979d7fb6a69fe04e97cfb5403a509ce83d6f552db5b194c83d236d38749b
-
Filesize
173KB
MD51c8e25168290cc3abafcaacc2051b245
SHA1e889441aacf32480b807597d5eefa709f56259d3
SHA256b9dee8ebc1db5ad56372e983dbb712355ebbf526e6003e91d3be465c72bf1463
SHA512087d7b10be0e98b73dd71117b5388c163d9486096c8d30e8b36270cca9a7a4a9b78ee64ced1e959ba481283ded2f192b90bdf486f6a1956307661b6d3d4fb2c7