Analysis

  • max time kernel
    155s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    07-03-2024 10:14

General

  • Target

    0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f.apk

  • Size

    3.3MB

  • MD5

    8d958576257733bd78fe81f84e768ed1

  • SHA1

    cd19e464b30b42d80a532cd994828696dc5f7b9b

  • SHA256

    0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f

  • SHA512

    9352203c5c06e69a2521041f3eb4751af80295ac50828b3e6a7d653198e6fb4db671b2fa214e3e3c166cf2a4c22ef54a5e87e40d6ce145a32a5c23b71a487683

  • SSDEEP

    98304:TAxM4GZm5vjgae1B4IIDjl5OMxeAPuYXv+r5Pd:xZwMaQ4ImlAYeQuYXv+r5F

Malware Config

Extracted

Family

hook

C2

http://77.246.108.116:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5083

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    84d5efe02db885b02687dbe4ac0b344e

    SHA1

    23dc5a7b16f610b08169e51e03f40123e5798267

    SHA256

    7f1d65174b7072b16a0f74018a9a9b704881b0ceba052b7df7b7904dab65ed37

    SHA512

    402f3dbc5f6ddab43d9c79d5736b9f056c43b012b6c57d4e57c691e444fa5f5d1b0bcab5634adb12bb05b1c3a19bcd9c226af563982bf2855dfe6d36baafbd50

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    5010d82127fcea6c5581145c4ce0c199

    SHA1

    889f0bb7afeffedb495b26bf8abcef9ebd586fad

    SHA256

    ba2aee1dd3e11b55dbe00f77b49cf3208c4e91c8e25018c0fc44275a1f37f9b8

    SHA512

    2d9a7084ce15ed268da28eb8f99d138eee2c8a23a6eec26c6c1ec5e45d8a5c9955fac5bb7a4d62d7cd50e497353c09bb598f571e08b13b625a075ed19b635f70

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    156KB

    MD5

    a6357f6453df617bc7e47fcf6e4c3c93

    SHA1

    300fb93c4060b58d310a21bffdda420db0889379

    SHA256

    5c9b785446c7b352d1634f80bedcf07d4be93ac7ceb5989dafa1c8d7956c67c9

    SHA512

    507937fbf7c0aada9d83698cb93ce9a790d4dcadd3b37022840b21c6ca3ca1bc56cc751fd3bfb69951f606b5515e6cb29f585db596c7ab69abd3bf60d9101d67