Overview

overview

10

Static

static

10

560bada1b9...59.apk

android-9-x86

10

560bada1b9...59.apk

android-10-x64

10

560bada1b9...59.apk

android-11-x64

10

Analysis

  • max time kernel
    155s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    25-02-2024 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.apk

  • Size

    3.8MB

  • MD5

    508280b8a33592fe3e3ec3bab918998b

  • SHA1

    72956fc4394e95b0eef71dd330ef27d453cd2c36

  • SHA256

    560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59

  • SHA512

    f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311

  • SSDEEP

    98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS

Score
10/10
hookcollectionevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://91.92.250.168:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.trendyol.market
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4465

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.trendyol.market/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.trendyol.market/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    46237f3a25ec5d2ea52e2e2239cbf15f

    SHA1

    ec286cf67767d01eff786e8e8f71ffc87a80595d

    SHA256

    8fef117ddf7c82cfa072b73ce071e05cb57fff65cf97fe0c4ae631e889b94d45

    SHA512

    f7279ef496050caa45ef1ec17ab5c3cc4fa19bf00d72dd2d47b77af55057287bcd6177b237057ff44c1fdc2e9dceac112a9fbcf2be3987319c340988fcfacb83

    Download Submit

  • /data/user/0/com.trendyol.market/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    3bc9f402b421ba4d38ee2d6bdf026878

    SHA1

    f15e8db05904ac883cd24517a948e2b67a34651c

    SHA256

    02795becf56e61caee731c5b0ef24bd3f9214671f500736fb5153775ce6d8456

    SHA512

    bb54b477298127647e421c169c556b6311097353de647fa3c34bba4bb8e355308e6e2cd861c134494743667a878082d42a877926136e83c7af38f104162c11b8

    Download Submit

  • /data/user/0/com.trendyol.market/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    a26a16e7f6f89f875b23604f9d323801

    SHA1

    b161b3caf57db4889dbf26f01dbcc546325ee220

    SHA256

    a2c01d42d7fb158927046dc85c4f1c002486f52188e8b3c0183da8647fdb7999

    SHA512

    a80ec5c687b84f844743a355cbaf36d6f81b36ab7aac41824534d4e1d17ef252a2620444fcf2076757f93634eb52694a7d3226ab8948c693055920081d97cd72

    Download Submit