Analysis
-
max time kernel
150s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
09-03-2024 22:03
General
-
Target
975bd294cc538b2e270381421a52efce6a121fca342327c1b9cb304805c87736.apk
-
Size
1.2MB
-
MD5
f42b5b75570aa86122ee6045a24790b6
-
SHA1
ed0b6d8bef694cbd5444ebe95c15a1283519444a
-
SHA256
975bd294cc538b2e270381421a52efce6a121fca342327c1b9cb304805c87736
-
SHA512
36cf6cfe62da07ac414c0bac78ae4c5f308835d8713eb9b72476279e8a28e4f11d9f25438e2b50b5eb384700e28eb3fd5ac04b890dad44cdee7f7c6b67e332e5
-
SSDEEP
24576:3rgD07HDT4Yur9SP2CNzpf2v+dk4rq5TWOLz+1IgSm+:3rgNW26fYYTrq5TW0gSR
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.nupimunufayecihe.xutitaxu1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56b9bdf43f541fc15efd4478cce75618e
SHA1656e59cecfb1d51c049c9606e3b7b7121bca3bcb
SHA2569494b5fe860cfc8f19df2951835208fcab68699096215cd41768c79b52ed44cd
SHA5123ad670a44adabfb33c01bce7b7732f6972930935fa4a6cfb3a955642cf2be624c1841d4c6b614a2eb7c3b705c18d822efe69c84075a89baae3f6e327913a8e25
-
Filesize
16KB
MD5c78f2da2f8380b7286801b7afd18b048
SHA145371a262156b752a2a3eb2cb4588ed131ae9678
SHA256f158de2d84b37807d478bb45390c1aa64336e6880b089c56f98e460a01ad9ef7
SHA512ef0a8aad59759345ffb821ea80d4d6151ea0bc45f5d611cf613be1de494ac9ffa47090d0ed5daa9d1c751fff79b23f7aad95b74aed14337b511ac4239483bc95
-
Filesize
173KB
MD50c39a20b98c90e9f1da5da26add9594e
SHA1a135b1bd1c55246044c58299189453d9a24025dd
SHA256e80b220b35d7e313296079eacf9caf8347f7b553a3db42639ab08b7fec381519
SHA512bc22dcecf902ee0ea0508fe9f8f06b35b0d4b04b553127a16de9b1b644f78d057099ff0cafa410bbaa89badf0646b7be185242594404aa82e183ae72c0e88a91