Overview

overview

10

Static

static

10

ed0558cfbf...ff.apk

android-9-x86

10

ed0558cfbf...ff.apk

android-10-x64

10

ed0558cfbf...ff.apk

android-11-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    143s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    13-03-2024 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.apk

  • Size

    3.6MB

  • MD5

    5d391a83a4c4f2e11bd9af3fce04118b

  • SHA1

    1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11

  • SHA256

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

  • SHA512

    d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27

  • SSDEEP

    98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4248

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    f6da32f515e527798d018d4272549e2a

    SHA1

    421f1c3591eafbf11b7b1c6189c57ecfb7131196

    SHA256

    7e469a81eb28c08cb7e01dad30623a2d7518fc622a5d256c5b183ebcbba2256a

    SHA512

    245bf23fd2f966fead6b69900fb9c562588827d37469b8124e48e070910e2b61b90a8f3d761092989c69f7ec5078c70bf816f6821ce5f9ca5b17959b304a2154

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    1ee9982c8e178312c2e35235497c17a3

    SHA1

    d06ad4cb0d6ab763600598e01dbfc9b2eeb2e038

    SHA256

    b50e6afde22899a9c414103bcc734ed6839d0141e70e65c6c500c45341d6b8af

    SHA512

    69bdf6a50267099ec75c7964712fd10154eb0ba4972c1f2243470a003c3a072a289327476389987884d4f5927b919c04b42f57bd95d46ddb0c7e06226dbf7e19

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    2b26bd89a4eb298e76a1cd2c1553521a

    SHA1

    f3afb8140b413618a879df23642d273655cf55a8

    SHA256

    169a5c5233afc72cffadcf97d3777dbee771d9c609eabaf94a6339cbf46ea70b

    SHA512

    62fd715863f8cae8845d5b77d07396b58cddf8a325c0d062a396d3d383fcbfd4c9300d2228643b00d04d5ab0bb8ef6d8343775cd24e7fe47f7434e4e40b6124a

    Download Submit