Analysis
-
max time kernel
149s -
max time network
138s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
13-03-2024 13:33
General
-
Target
dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7.apk
-
Size
2.8MB
-
MD5
4e0e33d1fa3467cd88e4ced9cdea8077
-
SHA1
3ddb1492fef6b0951c172a307f759f3dc962e2a0
-
SHA256
dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7
-
SHA512
8a91faa21cd9b67103b8ac445d36c698f7d729d7704c8d61407cf1a8612ff68dae8c1c4ff23c73fd82c4090ef82de688a10a5b38de1f0f06b2133d47a73e0978
-
SSDEEP
49152:Pi2q5Mqa4wh8vEZLi5APc/fbmFY8wGfFF5R2o0Rnw0rw2pl3Ft4y4X3wmAC6lg/q:alRavrg5APwbmFY8wGbD2o0lDw2f34RW
Malware Config
Extracted
hook
%INSERT_URL_HERE%
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD508338a0f1a5e570293a195d7c8cc9bd2
SHA117555e1f96952f22b6c1961417fcb8ca61b48a02
SHA256e60c791b7c65cb5f7de85ca06732baff2dc7db6f206bd116e455fae74ee4c81e
SHA5125a7311430b9b503bd29e871c6a84e2957c464de3330245bc9e41784362ed4b6b8153862616a0800647524cc3725464a429756e8fe900d05f329397b5003a4090
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD59e5715df5dc8bae633bf264f1a581cc8
SHA151bdfa13e5b5e98c3554f61e2a13ebf718d79cd3
SHA25659122449b060000d7de01a73bf5a561cfb40d6761505548832392fef1259fb59
SHA512afbfdbaae211a910a97ead94a1fdfa523bfec47e953e26f88b04261d8745a3a657cc1335caf038bcaefafb539ce70f6a99e599a1b522558e6777f7595c4bbc66
-
Filesize
108KB
MD5aaa5d356e6053b67b7c450915d48f5f3
SHA158337a991a3b9b28b27140b17b2d5bbff98587f5
SHA2564d0e50ad3c2e146ef87b0ce364b0e37c03d5980bfa8b9af904a51baac6b0a490
SHA512f1f4abad4873c715a779ca879305a6a804de7303ea7bc79b812fe5ebb947d945b98bdbabfb5ddab026ab0e10ab15253caffee89e89e56e9f05e8cf6cb54c1b6b
-
Filesize
148KB
MD5206bb6c0b2c726c86a1d3dcd327c61ad
SHA1a9d59d87dc678db6bad3d48b8730151324144e47
SHA256365488a1e2d2d601335dbe485b519f728c37c1673508d4f2ac1ee013b08f4f58
SHA51208c2db70faa1ea79180710a3e6ff818994a87bd7208ce0d912276497bf7c974df41a0e1f03e714da397c4221ec296a011fe1e8911691660876df26b9be00824d