Overview

overview

10

Static

static

10

ed0558cfbf...ff.apk

android-9-x86

10

ed0558cfbf...ff.apk

android-10-x64

10

ed0558cfbf...ff.apk

android-11-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    05-03-2024 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.apk

  • Size

    3.6MB

  • MD5

    5d391a83a4c4f2e11bd9af3fce04118b

  • SHA1

    1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11

  • SHA256

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

  • SHA512

    d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27

  • SSDEEP

    98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

Score
10/10
hookcollectionevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4703

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    4318b4a7b9d8fa7bd91aa6c28484584c

    SHA1

    11de72083d09eb96d16ad71d89554739f8f4fa6a

    SHA256

    e6e0c4e6b5dc74bdbdf6470e58fd377de452ca67c9f8f21b349d3400784f53dd

    SHA512

    ce7a14abd0c0bf534fb0aa4bff57d64832db160e8d7d831ba4e185cbdadf74229f1dcc883a908dae74b12ba48eb5938a0218feb2ac88d08ed79a9802e0bd1d7d

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    bc748e75149c909863afe865b272a02f

    SHA1

    34a3be881775171ecd9869dd739d3731ebba4593

    SHA256

    f7887998814c46ed69d0d4591cf32e76721b30fdcfe3f869fe4b6c1369d41a6f

    SHA512

    bff3e556fc96d1819c91a4a32224e7cab85e6e08852e134618fcdd824407f47cfac0c6a006c60bf6766dfa72a2742efbaefbb8bcf812ad6c2d79e8cd12d4bca8

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    1eef106f326e4d7b2138fc00b770653e

    SHA1

    abfe2c935b197c521fb9e96feb1fc3f5763e6a0e

    SHA256

    a441a5c38d3dfe200767dbbdf393b1bc6993d818ff9f1ba6b3aead60406145c0

    SHA512

    401206062964e2bdfa67266ea5a8b8610215adf12544d3c6c194c8c02fd4257ff79d2c7fc19208e8ea8194b2ae38b40e0a8fd5c52f9b5af4cf00466b3b45429d

    Download Submit