Analysis
-
max time kernel
55s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-02-2024 14:40
General
-
Target
app-release-2.apk
-
Size
1.1MB
-
MD5
7c29721ae5193bfd4441b1761d584411
-
SHA1
acaea84348eda0df39bb908859627cebb3e22a48
-
SHA256
80fb4a2bfab1f0675eae40210a899a30987241cbb2b9497eb753668f433682b3
-
SHA512
0d7dfa4be7596e0ad174f27d79193b008608735ca92dfaf1d06abc74a18a00c3837f19a5623fa0cf122b853eaeade72d0d8fa2d0e3f98b4db01585a88a6088bb
-
SSDEEP
24576:x+iQHis9qSTp73z5HbjJe0HIbTzB0TlOk/ojy3fg/s4wJ:x+iai+q+xz1Y0HI3zBIJ/X3fg/iJ
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.bofevacotexi.jepula1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
429KB
MD5ef9180f2d6baa6c7214403ec8f3b7ec5
SHA10da13630b0c13810bcea946dd88ec66774fcd502
SHA256e56c2ca20f560f0c18610d592394f6aeae28a5838d03c7bcbcc5904a56b8e04b
SHA512aa76abfe5d0d76ce1630d99b0b1ed133e782d30725169c9090529ac93c81251389a68153299013aa7a89af0d0430475d52310b7639ca048cb1cc516fa8ce879a
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD509c5bd80b16bc6f100e26d7990113a72
SHA12a51d272bc2678efc8d1e8fd3374e86e82381d64
SHA25610dda05ce15b2459dd8a8cb6dfadf61ce4b096877a38a2ed9b03872b89faa7ce
SHA512b7c546c54e47a44f0c840d63f6c5525e231f5688719fd91e91f7e3c32f7b0d533c5d3847ea9d253c707efd0cbcbc1e21a185a7564d0955e9f194f3ec0d3a2f7b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD510471fbf3eae8847780a24ac132a7073
SHA1446b9cb201c8efaa942a8773f4bf1a5435ce068f
SHA256d44280cd3dc9a11a97326cb220f3413c1f429612cf6205c6e40a7ef3c200a0d5
SHA512e2391c3cb9d3527870a1c8fcdc48024c3e75be6241e93d500ae1579ce2244cd103e2b51f162894a48821c8ee6e1f6196242fa078bf48ff31f7318a5b8703faa5
-
Filesize
108KB
MD50597516027e821601bfa9148c978a634
SHA1895c80683d0f600c214321c442cef75c06ce8870
SHA256ad2c7fe8d534699f1e79799f6dd12e050651df7b54d5099122641060d5591ebd
SHA512d450c607783c4f569ae2e7b862bedde3bf590c062c329a6192fa0953e3bc1b49431ef58c2983c8a17968e49487528885296d88f6ff5be6f5f77b5a4bc22485d7
-
Filesize
173KB
MD542a76f9ce421114d3467e48828eee465
SHA1c59d522dfe65487802b74a74a97ab962bb0e32e4
SHA256f2b6e3b4131cae1ef62954d47596855e41776303d5fb1d40de835fa769369a3a
SHA512fdd969c6e88a3f4e71d12b367bf1f98e9690ad1b351745e96faa1df45ab53f6c6a5db4a5baab5c610721d79936ba2559ca05bb976785eb62e768784d59caba69