Overview

overview

10

Static

static

10

3ee0b5f142...53.apk

android-9-x86

10

3ee0b5f142...53.apk

android-10-x64

10

3ee0b5f142...53.apk

android-11-x64

10

Resubmissions

26-07-2024 21:18

240726-z5rkgsydma 10

13-03-2024 20:54

240313-zpt1nsaf53 10

13-03-2024 20:50

240313-zmj3page2v 10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    13-03-2024 20:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453.apk

  • Size

    2.8MB

  • MD5

    db6463dca0973bb704ac9fce68a1dd23

  • SHA1

    c35ffe6ab3797981da3b8fd830d4d0b3f3b24e2e

  • SHA256

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453

  • SHA512

    bdae2fe17fb616a22c8559083e30d23ae5030923bb3dd95f7bab6e7ba38d19a22fa3140048f6cd222b2bbdb5087c7b9524fd695877734b3f64c5c809144f4fd8

  • SSDEEP

    49152:9OcwHfICXpT/JVb0Tnb3fj29kgzpWUYCHBSZyL1xB07DsiHDwJAC6lg/Go:cT/ICXlvb0/PjakgPYCHBSZC1XCYiHC1

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

%INSERT_URL_HERE%

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:5102

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    d1093cbbba2b030701d86059feb09bc6

    SHA1

    772e5a9cfebb6f5fdf1a9fc52d7bbe33a9bb89da

    SHA256

    6d4b057bf99ba353906cdacd006c8483a6541e0b8ad56bb33bd98bc9eb578589

    SHA512

    c94aadc602f05f2ac826e0b92bcdc2d484602d3e85b55cf040fd65bfae2253618088452a668a4fd47331430e05672de4ba49c968ed780ed18cfa839bd35dc5a2

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    99463c7f22daf786c0d607844ae12b47

    SHA1

    05b5c037156d68f849345c81f3e8618d88c59c94

    SHA256

    a30d621741a2adb395c5195e60a5aa3480128cc306b7dd67ce647b445d028853

    SHA512

    c706df0710ca0c834d74691e0a548156bdc61cb1e4713557cb809c89b3edeaf9a53fbddf2e67e9eefa8e19de085feb6432b874809c351a646606f69189eb6575

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    156KB

    MD5

    e35635f36e88fda673923dd1802389de

    SHA1

    90d6a6179eb528c094c32d39165adff20a931039

    SHA256

    26573284e863dda7b21a2bfddbe4e9ba6fc819421d03b7dc86ed93fe4be32e31

    SHA512

    4f9c0e797466a5591df8674e99e4d80d30418f873551da1450e643d4570c057e9621e4507f3d9b8c8fb16c3c11163b0066fe3ab96876caf8b4fac71c5c932194

    Download Submit