Analysis
-
max time kernel
56s -
max time network
148s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
09-03-2024 22:03
General
-
Target
9f48b10023f35097e883c7b02ba68166ea9412d2ec2684ca20c1ae38fbe42081.apk
-
Size
1.2MB
-
MD5
0a1e564fd5962490e45bcb8d71ea6283
-
SHA1
ab113e8397243f6c6f86cc3ac3a7ff4546c5fa6b
-
SHA256
9f48b10023f35097e883c7b02ba68166ea9412d2ec2684ca20c1ae38fbe42081
-
SHA512
f9299a04668114168824e6bf7248a8b6ecc30e455b9a9bcff845e7d62018ff029f43e0f36f40f7a69fc8a9940cdb42bd153f3f81d327ac85ba3d84c9132a164d
-
SSDEEP
24576:Cz9XJxtkyhg45RJiL8s5F71kn7OH41ZNbgSkDXQ:Cz97bh15RJiLvJN2HgSKQ
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.kicozapiruxesati.tasulu1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD54bf072400ec9e0ec4456f1463ae1ae54
SHA1b8bcd0d4d844f145058b0d5bd60b051bfa3c5f1d
SHA256860b84b35b5a22d1c1574164d9d26c1fdbf61b26806dc03e9d1c22df6d7ba6e9
SHA512b0e0e7d73103248a459249dd8af0e97307503aa451d7f060c5caaeb2bb3d720c81af57be229056eb19aed3db331555fe55341cb8dd8548692b60420f0d9d6bc9
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD551882fbcea9be01c0fefcf87b6440bac
SHA1d1198a7487182d6f7dc6d0a875c5fb21be58ff14
SHA256a9df53c7399bd3f59f7ee5c0ffc51f1023d0696b51fbf9682679b4794b44dc66
SHA5124b15b05db60c4da3291a3f7e9c21d1bb3e46fa5e35b89e927b7bbbb19f0c7c0a1a256698ebf4a298c921ecf48de18d2ded3626adfbaf782eedb800dc64c00d17
-
Filesize
108KB
MD5726b0f5d14dadfe686f4db168fced9fa
SHA136251515fcec43693350763804d57853007bc0b5
SHA256784e46c7628ea75cb9713b320bf164397b92bc59344912e782278f5a3d4b4c87
SHA512da208faa9adb5d8ec4186c413f6cdbc2ef9f855f1390cc6d7d248303e35810a4ac3b81ccdd2eb35b4fcf21e3cdaf68243b9a708ebd6059fbb715dd92af7b866b