General

  • Target

    app-release-2.apk

  • Size

    1.1MB

  • Sample

    240220-r1zrasac88

  • MD5

    7c29721ae5193bfd4441b1761d584411

  • SHA1

    acaea84348eda0df39bb908859627cebb3e22a48

  • SHA256

    80fb4a2bfab1f0675eae40210a899a30987241cbb2b9497eb753668f433682b3

  • SHA512

    0d7dfa4be7596e0ad174f27d79193b008608735ca92dfaf1d06abc74a18a00c3837f19a5623fa0cf122b853eaeade72d0d8fa2d0e3f98b4db01585a88a6088bb

  • SSDEEP

    24576:x+iQHis9qSTp73z5HbjJe0HIbTzB0TlOk/ojy3fg/s4wJ:x+iai+q+xz1Y0HI3zBIJ/X3fg/iJ

Malware Config

Extracted

Family

hook

AES_key

Targets

    • Target

      app-release-2.apk

    • Size

      1.1MB

    • MD5

      7c29721ae5193bfd4441b1761d584411

    • SHA1

      acaea84348eda0df39bb908859627cebb3e22a48

    • SHA256

      80fb4a2bfab1f0675eae40210a899a30987241cbb2b9497eb753668f433682b3

    • SHA512

      0d7dfa4be7596e0ad174f27d79193b008608735ca92dfaf1d06abc74a18a00c3837f19a5623fa0cf122b853eaeade72d0d8fa2d0e3f98b4db01585a88a6088bb

    • SSDEEP

      24576:x+iQHis9qSTp73z5HbjJe0HIbTzB0TlOk/ojy3fg/s4wJ:x+iai+q+xz1Y0HI3zBIJ/X3fg/iJ

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Acquires the wake lock

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks