Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

dbd8366157...d7.apk

android-9-x86

10

dbd8366157...d7.apk

android-10-x64

10

dbd8366157...d7.apk

android-11-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    14/03/2024, 08:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7.apk

  • Size

    2.8MB

  • MD5

    4e0e33d1fa3467cd88e4ced9cdea8077

  • SHA1

    3ddb1492fef6b0951c172a307f759f3dc962e2a0

  • SHA256

    dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7

  • SHA512

    8a91faa21cd9b67103b8ac445d36c698f7d729d7704c8d61407cf1a8612ff68dae8c1c4ff23c73fd82c4090ef82de688a10a5b38de1f0f06b2133d47a73e0978

  • SSDEEP

    49152:Pi2q5Mqa4wh8vEZLi5APc/fbmFY8wGfFF5R2o0Rnw0rw2pl3Ft4y4X3wmAC6lg/q:alRavrg5APwbmFY8wGbD2o0lDw2f34RW

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

%INSERT_URL_HERE%

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    PID:4265

Network

  • flag-us
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.213.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    216.58.212.202
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    216.58.213.14
  • 142.250.187.206:443
    tls, https
    858 B
     40 B
     1
    1
  • 216.58.213.14:443
    android.apis.google.com
    tls
    5.6kB
     8.7kB
     16
    22
  • 172.217.169.10:443
    semanticlocation-pa.googleapis.com
    tls, https
    1.2kB
     40 B
     1
    1
  • 224.0.0.251:5353
    3.7kB
     11
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
     320 B
     1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    216.58.212.234
    142.250.178.10
    172.217.16.234
    216.58.213.10
    216.58.204.74
    172.217.169.74
    142.250.187.202
    216.58.212.202
    142.250.200.42
    142.250.187.234
    216.58.201.106
    142.250.179.234
    142.250.200.10
    172.217.169.10
    142.250.180.10

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
     109 B
     1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    216.58.213.14

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    93b6c06a8ee780778d7be93e4eb72180

    SHA1

    a159f8f0a73a22ba6dd794608eecbeee7b6675c0

    SHA256

    db6aabb37cd893669052ab206d635cc435b605c4c0cdb84fdfa27bf4d5ca3753

    SHA512

    4e2d92f3fa6655c4fbc30d8cfa6c295667d9a63c3cbf109434bdc66ecc68e941219252e145aca57f31908a15a93cd68f5f589cbf28512eb185b26c4a68b7a950

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm
    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    7ddc9dbb27885be8c1d0517be0e562b3

    SHA1

    ca154ddb1a33195e2aa8e914e08d3a4e6bb874cc

    SHA256

    e446441cf543641bf5a756a5a2a01ff18f64d236a2fb21d477e9c1b171bf25d4

    SHA512

    343d520174906181ba11a43bf58d4a74ce5ea9a636aa93a2503c40018d01d4c4173884e4aea5af199e415d7084e5c71ece29778285d279437864a08dcd9c07b2

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    3883f62d03bf9bd0c88736ab9309735a

    SHA1

    13f52e2cb68d22629b0bc5c5b6da97d754ea41f8

    SHA256

    efcfa13464843d54d88cd21e5ab7ed23e3874b5a7ebd01c3708ca339dfe64b83

    SHA512

    1069449266f083805cf10a7f7a56975824e9582729a9db7bf8a15f4b9fbb021a9ee29f326e5f448c721d8b8e9cc97e07bda8bc7007625b747d2c3e022b9ac623

    Download Submit

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    13b3f7449079f7cb2f7ac0e5f1edf790

    SHA1

    499afcd67617c7f5d452e5aa88ab3c348236566b

    SHA256

    5b9c700267bda55c531df6ee6c7fe91ab4cfb043884f73d2904eb56740ad08ef

    SHA512

    41db044d542a4dcff8b820ace20bd1a0441b823c1e5f04b8d85f0a9eabda84d5a26854efc3d5f367d497cb758545aa4369855ed570d2be38ed2dcbb3c8926c7f

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.