Overview

overview

10

Static

static

10

3ee0b5f142...53.apk

android-9-x86

10

3ee0b5f142...53.apk

android-10-x64

10

3ee0b5f142...53.apk

android-11-x64

10

Analysis

  • max time kernel
    158s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    13-03-2024 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453.apk

  • Size

    2.8MB

  • MD5

    db6463dca0973bb704ac9fce68a1dd23

  • SHA1

    c35ffe6ab3797981da3b8fd830d4d0b3f3b24e2e

  • SHA256

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453

  • SHA512

    bdae2fe17fb616a22c8559083e30d23ae5030923bb3dd95f7bab6e7ba38d19a22fa3140048f6cd222b2bbdb5087c7b9524fd695877734b3f64c5c809144f4fd8

  • SSDEEP

    49152:9OcwHfICXpT/JVb0Tnb3fj29kgzpWUYCHBSZyL1xB07DsiHDwJAC6lg/Go:cT/ICXlvb0/PjakgPYCHBSZC1XCYiHC1

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

%INSERT_URL_HERE%

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:4444

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    9deb1b9942cb6277a0dfe7d41069b9f4

    SHA1

    4287247bb7c473b8b283ee117ca12608624a36c9

    SHA256

    d21d24987014aa5268086c33ae839f9f7ed1fb1ebad68ddf04f2030b033ae259

    SHA512

    a57ee2bf9ae43765e45a1247e38020f43c186bebff95b3f5638087d2ba4aaf1061dd682ec37b46719a3d3c8cbfca3e0962c23c5d8791ca80f128e98d860403d2

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    5d7a738c7aace8cc0d95ae2c17f60291

    SHA1

    1b7069ae8e872280eddbea2a3a2c3316de04873b

    SHA256

    d4e3f430a606dd3ba33db5ad3ea55c56ece52deee431e16b1d5ecaacf377b6ae

    SHA512

    79f3fbdf2a4b14339355793276a2c532f7134b05fb6589c50b504b9f9b410518e66ce69cca68ba3a74febe39a53868c6d343d543f45709d4cf4c391a45e20012

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    5142b066b2a2e09c3a4f2aedcbd0934f

    SHA1

    22a77c11acba956c404bb5c49216d622f47689bd

    SHA256

    7635dc6aeb143994dcb9000ea8017c0894cdef07617cc40934b44bcf9a7cc548

    SHA512

    0d699d6a51f9977bccfd91f9fdfd5e9ab2e65e66e56871f39627828a392c4a3e8bdcc68ab6359dc82b5244130bb456e433edf5b74b4a6964203ca9b11360f6ab

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    02c720afc98d319575444d46ea7072bf

    SHA1

    1fced8f39dd923d8fcac085f30386f166fa97173

    SHA256

    d1db8da206c0c5f795b53b63a1c1f2724fc6b372f884f17d4d16882aace37e06

    SHA512

    770edec1f278c1cb490090e3579843a81803592a82520d426a88423a29b86cf1d485f793efbd1d0d731818a4144d93c62139e750da32ae696e61d815001e9ce7

    Download Submit