Overview

overview

10

Static

static

10

ed0558cfbf...ff.apk

android-9-x86

10

ed0558cfbf...ff.apk

android-10-x64

10

ed0558cfbf...ff.apk

android-11-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

  • Size

    3.6MB

  • Sample

    240314-kx8fpsfg4w

  • MD5

    5d391a83a4c4f2e11bd9af3fce04118b

  • SHA1

    1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11

  • SHA256

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

  • SHA512

    d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27

  • SSDEEP

    98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

Score
10/10
ermachookandroidcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Targets

    • Target

      ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

    • Size

      3.6MB

    • MD5

      5d391a83a4c4f2e11bd9af3fce04118b

    • SHA1

      1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11

    • SHA256

      ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

    • SHA512

      d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27

    • SSDEEP

      98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

    Score
    10/10
    hookcollectiondiscoveryevasioninfostealerrattrojan

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

      rattrojaninfostealerhook

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasion

    • Acquires the wake lock

    • Reads information about phone network operator.

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks