Analysis
-
max time kernel
146s -
max time network
149s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
13-03-2024 14:22
Behavioral task
behavioral1
Sample
cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b.apk
-
Size
2.8MB
-
MD5
dd1d59363757b52f1a3139847fc30890
-
SHA1
38db10d0719d2fdc438deea7ea8fd8e4facdad4f
-
SHA256
cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b
-
SHA512
b23d5ee3aa0f1d277c53bf6d502d805a57e640679488ba03c4f68d4a882f9de6cbb1455e30eefff5181d1f5177178f2f7062c168d28204b3d0509438bef768f6
-
SSDEEP
49152:nozl7D4fxxqNsvuha+i4bLkzLfGqg8k9IZKxfVf65q4h5xxKAC6lg/In:ozls3hiaR4bLkfuqCsKxfV65q47xxDCk
Malware Config
Extracted
hook
%INSERT_URL_HERE%
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tencent.mm -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm -
Reads information about phone network operator. 1 TTPs
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD555acf066c97971fff92112ced76ba96e
SHA1d540a3f904693fee02abcc2814baed225ec961a0
SHA256b5d474a3c33b60a8cd9a5a4f45c45616b907dcc33ea9f620debe9d731d6be6e6
SHA5129df006aabdd99ac3488692ae5e576f19d52815ff72dbc837b2ce994ec39b332da564f19901b956a726c3593141c48eb32d2da6dedf986cf64bf7a53e3d3fe32f
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD5d77629c4010e0204742f37f44c053f08
SHA1d5152de25ae5625168d11c7898c90d28c59d873b
SHA2567d4b6e19792d51a11431d19208878805399cdaed6357fa9b4f0e422155e97890
SHA512862309b843bbab1e464e90f1b45830b9d67239a2137345da6655359a69d774b3421c6921f2380137ca1baa64f6d5b0a4a631a29dee45f79102d8afb09dda0c67
-
Filesize
108KB
MD5decce373779f9b183e859b378d50dce3
SHA15c09a11686326fc5d39dd81731ced3892c80f624
SHA2566a389803c58da4f32c4c3e275020863658eb0768c9cc800a31f10075a07e4269
SHA5126bafb30ac333228c84b66da64f5067ef6d283ba098443bb5a9bc6947a8209d520711a900e1a2f080cd900f77430ade2df3ebe859ba4701dcf6da9656d140989d
-
Filesize
173KB
MD5de13b3855b91ecfcee5da9054111d678
SHA1c2dadb36d9d88331b91e9319883d507d77701c06
SHA2569dab4aa31f0cfcc6d95fe6b4516d23e66d7f70e4937427991a9a202291fb2c69
SHA512e6c543554c3d161c85f748a909bd148d50ad27a9f0425f84c15768c1514b08ab0a0dd283c5bc0a42f7b187f71c097a92e4761722a3e6a7199d6b807c1aeaa839