Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    13-03-2024 14:22

General

  • Target

    cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b.apk

  • Size

    2.8MB

  • MD5

    dd1d59363757b52f1a3139847fc30890

  • SHA1

    38db10d0719d2fdc438deea7ea8fd8e4facdad4f

  • SHA256

    cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b

  • SHA512

    b23d5ee3aa0f1d277c53bf6d502d805a57e640679488ba03c4f68d4a882f9de6cbb1455e30eefff5181d1f5177178f2f7062c168d28204b3d0509438bef768f6

  • SSDEEP

    49152:nozl7D4fxxqNsvuha+i4bLkzLfGqg8k9IZKxfVf65q4h5xxKAC6lg/In:ozls3hiaR4bLkfuqCsKxfV65q47xxDCk

Malware Config

Extracted

Family

hook

C2

%INSERT_URL_HERE%

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:4467

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    55acf066c97971fff92112ced76ba96e

    SHA1

    d540a3f904693fee02abcc2814baed225ec961a0

    SHA256

    b5d474a3c33b60a8cd9a5a4f45c45616b907dcc33ea9f620debe9d731d6be6e6

    SHA512

    9df006aabdd99ac3488692ae5e576f19d52815ff72dbc837b2ce994ec39b332da564f19901b956a726c3593141c48eb32d2da6dedf986cf64bf7a53e3d3fe32f

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    d77629c4010e0204742f37f44c053f08

    SHA1

    d5152de25ae5625168d11c7898c90d28c59d873b

    SHA256

    7d4b6e19792d51a11431d19208878805399cdaed6357fa9b4f0e422155e97890

    SHA512

    862309b843bbab1e464e90f1b45830b9d67239a2137345da6655359a69d774b3421c6921f2380137ca1baa64f6d5b0a4a631a29dee45f79102d8afb09dda0c67

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    decce373779f9b183e859b378d50dce3

    SHA1

    5c09a11686326fc5d39dd81731ced3892c80f624

    SHA256

    6a389803c58da4f32c4c3e275020863658eb0768c9cc800a31f10075a07e4269

    SHA512

    6bafb30ac333228c84b66da64f5067ef6d283ba098443bb5a9bc6947a8209d520711a900e1a2f080cd900f77430ade2df3ebe859ba4701dcf6da9656d140989d

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    de13b3855b91ecfcee5da9054111d678

    SHA1

    c2dadb36d9d88331b91e9319883d507d77701c06

    SHA256

    9dab4aa31f0cfcc6d95fe6b4516d23e66d7f70e4937427991a9a202291fb2c69

    SHA512

    e6c543554c3d161c85f748a909bd148d50ad27a9f0425f84c15768c1514b08ab0a0dd283c5bc0a42f7b187f71c097a92e4761722a3e6a7199d6b807c1aeaa839