Overview

overview

10

Static

static

10

3ee0b5f142...53.apk

android-9-x86

10

3ee0b5f142...53.apk

android-10-x64

10

3ee0b5f142...53.apk

android-11-x64

10

Analysis

  • max time kernel
    158s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    05-03-2024 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453.apk

  • Size

    2.8MB

  • MD5

    db6463dca0973bb704ac9fce68a1dd23

  • SHA1

    c35ffe6ab3797981da3b8fd830d4d0b3f3b24e2e

  • SHA256

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453

  • SHA512

    bdae2fe17fb616a22c8559083e30d23ae5030923bb3dd95f7bab6e7ba38d19a22fa3140048f6cd222b2bbdb5087c7b9524fd695877734b3f64c5c809144f4fd8

  • SSDEEP

    49152:9OcwHfICXpT/JVb0Tnb3fj29kgzpWUYCHBSZyL1xB07DsiHDwJAC6lg/Go:cT/ICXlvb0/PjakgPYCHBSZC1XCYiHC1

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

%INSERT_URL_HERE%

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:4433

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    1dd2096e4fd01cc4fcd491e8ca8a6b58

    SHA1

    6ff671d3bd225a5c62dfd302b3ee9b4be535f05b

    SHA256

    06edea557cc49331da549aff3245a890eb1915a1806606df4140d682a171fa5f

    SHA512

    89ee760c46fc5e01523c8a6985425391b50db2dfec33f6245578105a1e82c4d04b35e6ea2e7e38aa9afe072dfe965f16c3e78e4ff4552d89ec77d7210b5bde67

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    114755d30b625041b85bdac578e9a68d

    SHA1

    d932edc793e83c9c8a1665aab50cb12df523bade

    SHA256

    8e063fcbdd33b9fd171dae923c42e09830aadc0e4362b0f8bb19b6ef58e77122

    SHA512

    833b9b12869aafe7d63d1412f850fc8eb7632c6889c05b1b57f097a2d63d8ae1a8cde2e2a2cfd512db7bda6720caebed415b768c5fdccab348e48d2608530d46

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    13a9611e4c80a217b850dfb65e06ee5f

    SHA1

    97bdffad18ad6c74f504f7ddc1994806e6622297

    SHA256

    1725007fbeb17fcb84d9c61d796ec18af0d79801e96b9978dcf5f56825b97012

    SHA512

    1897cae1501482c75a3d5bb1b0b9d7ee76f116334ab449d91dca08281ee95a7b535624eebf7c563ec3c15d86943f59bc9fcfe96dff276ca44848c350cd864f96

    Download Submit