Overview

overview

10

Static

static

10

ed0558cfbf...ff.apk

android-9-x86

10

ed0558cfbf...ff.apk

android-10-x64

10

ed0558cfbf...ff.apk

android-11-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    13-03-2024 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.apk

  • Size

    3.6MB

  • MD5

    5d391a83a4c4f2e11bd9af3fce04118b

  • SHA1

    1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11

  • SHA256

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

  • SHA512

    d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27

  • SSDEEP

    98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

Score
10/10
hookcollectionevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4697

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    5f57a7b12f60f989d8437ec19d853ea3

    SHA1

    2b21fa3af86d42936d63386be547b16833909dbf

    SHA256

    7fcb9efd70adec1171cef3ca35774f39b024e0d62593436a5933c9ef6e5e2d79

    SHA512

    71a5d8611066212127cd647a9e74deb12ba917e9a4f2bbc9ab7c3ec7544279373672e50b079b9207598953e0c994dabde813b2bbc641921f3771969eb4eb5dba

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    be79e46640a6f763b94d65cadd7ce187

    SHA1

    a7117954685dba10be265cc3f01657852aced663

    SHA256

    36e287e165bf0b324abc8539b741a494ffdeb73a9f5e011667471d885f9ff9e8

    SHA512

    454221fe9d7fc41e27332dc74fa90876b35bfd7c444af2dba8a08e67a049376daf184649e2c2c0bfbe900d7d4342d23fc7519366302ffd3e1bde062e72162b10

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    498e9f7d271e52fcdc8933f57eb2b979

    SHA1

    2ce4b1d8d84b6ed89e30aaec8de8dddca42b15c0

    SHA256

    788220a0e5342ee8c69b62c8d9d4d536a28f44ff18198f2b65e3f74f70accb7f

    SHA512

    c1e3abf2fac438450407eb49dcecdbc6ac64d2cbd2416cb0ef91b95c52508957ddfad51c5c88bbec37a0cf6ff1a7602cc5f0e2746b6e4bbd69e56127c60df845

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    156KB

    MD5

    9cba72d5a19271dbb7ec0fa607f366b3

    SHA1

    82c133f25ee179461153cd04d63ae4ecef2e4e86

    SHA256

    a4ebc02696733a0d018ee2a37826705fa612372a3cc849ee4cb3e97154e57ea7

    SHA512

    12021ea9b1280f6445f03b9bc5462d82a50d0d84db64db1bc9ba977b1851aeea89d1fe54c7fc4e270783eb8bc225f4e6779a93ffef56387c32a96e9c15490528

    Download Submit