Overview

overview

10

Static

static

10

3ee0b5f142...53.apk

android-9-x86

10

3ee0b5f142...53.apk

android-10-x64

10

3ee0b5f142...53.apk

android-11-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    14-03-2024 08:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453.apk

  • Size

    2.8MB

  • MD5

    db6463dca0973bb704ac9fce68a1dd23

  • SHA1

    c35ffe6ab3797981da3b8fd830d4d0b3f3b24e2e

  • SHA256

    3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453

  • SHA512

    bdae2fe17fb616a22c8559083e30d23ae5030923bb3dd95f7bab6e7ba38d19a22fa3140048f6cd222b2bbdb5087c7b9524fd695877734b3f64c5c809144f4fd8

  • SSDEEP

    49152:9OcwHfICXpT/JVb0Tnb3fj29kgzpWUYCHBSZyL1xB07DsiHDwJAC6lg/Go:cT/ICXlvb0/PjakgPYCHBSZC1XCYiHC1

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

%INSERT_URL_HERE%

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:4458

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    f7ae70b1ac54d4afbefdc88bffabf7af

    SHA1

    5f5068c91f856e3f7dcd5d5b4cd59e10b767e59d

    SHA256

    c8605141648b4ea3bfbb98d9dfce6b489968180899cc183e4952bcede0efb8d0

    SHA512

    d2d575b359d7e6f9171403e419357c1e4ee2f58b2f3e8da13094dd75be7084347cd24e5c29d3426615ad6b0d3bcf0e3c0f79d1b523b5d394380e78faf6ac6cb6

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    1ae536a1653383115123b1ad7bddd1cc

    SHA1

    3bddc089fe0eeafde2636eeb0286f2798ff82344

    SHA256

    b94c110aad17af9c9def100ced59ea070a9a93b14d45f6489c530ff27845e867

    SHA512

    848858ce83cb13cdcd3f42207ee55040524e5e38ae37518b76468ebe8546a56d7185dab9c3f1e05bead7641feacb9a71775cee0b77ec7b9a15fedfb247cdbc7f

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    48KB

    MD5

    3682a268975fec721fe95ca30ff6dd64

    SHA1

    214a79a3b1da2e53d8a98febc3188da233dc9aea

    SHA256

    59a411aed904dd7265f8c401682e4d76b6e88b3cb5ced9d0c8eed4af4f2f1c79

    SHA512

    06f9aa99cc9f68c950678f1eda84a84ca11e5733e56d7202b4fd4a54d505de9b5b2710508d2a2473cc86c62832c9c0348eba49ef9cf1aafa3695aa98359b5803

    Download Submit