Overview

overview

10

Static

static

10

ed0558cfbf...ff.apk

android-9-x86

10

ed0558cfbf...ff.apk

android-10-x64

10

ed0558cfbf...ff.apk

android-11-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    14/03/2024, 08:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.apk

  • Size

    3.6MB

  • MD5

    5d391a83a4c4f2e11bd9af3fce04118b

  • SHA1

    1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11

  • SHA256

    ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

  • SHA512

    d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27

  • SSDEEP

    98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

Score
10/10
hookcollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4287

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.tencent.mm/no_backup/androidx.work.workdb
          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          Download Submit

        • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
          Filesize

          512B

          MD5

          b6b3c7a0cb17ca1403e65ffc1cf0180d

          SHA1

          680313193be4d3827beab1da0e3619927af86e81

          SHA256

          2658e388e5a8b4c7f492744c92bbdae97d37c90076eb9688df461b00c8c804f9

          SHA512

          b8f633609579b1106efc58adfd6c1cbefae5cbf9e1ba1ace9b706a2084288abd4b6a19b74df8e3374f821e2ebdac2705b3e0852e631b4c7104c012d259714575

          Download Submit

        • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm
          Filesize

          28KB

          MD5

          cf845a781c107ec1346e849c9dd1b7e8

          SHA1

          b44ccc7f7d519352422e59ee8b0bdbac881768a7

          SHA256

          18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

          SHA512

          4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

          Download Submit

        • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
          Filesize

          16KB

          MD5

          421e00b26b131bc4b4ad6a1ecd3a38fc

          SHA1

          50dfd37b4af0afc7b3b5cfd0de066e0bd251b3e8

          SHA256

          73ef6b97e4495329eee2ddb8720a28e18cd7ace6357f6571c8899cc27bbf1b00

          SHA512

          0097d9bcd6af15bd862add0464bb9392e204a745f87f9649e540a8575855269ee369ac9e977044b35ddd6f990cee7efea40ab4c81393e1c22a9de67fab04a75e

          Download Submit

        • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
          Filesize

          108KB

          MD5

          e9657013cd41c9d4bb0917630a14b6ed

          SHA1

          d44232e3e12af583b4f46104e1d90c596d1bb043

          SHA256

          6b9a813daf3b5c9230c2131a001532ee51e3b81bbfdf425b63beeb330ad65601

          SHA512

          6fdb676f592af6de496ca218f91c41138e98758d51a6412da5266333aa3c08554723a12c8e9b5909b2bb15b03e7daf19305fac7310642240c7d0f8261af5ce6e

          Download Submit

        • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
          Filesize

          173KB

          MD5

          44cd585564aaaf6c4eb6caea9157195b

          SHA1

          34a27574ad3d62995706545f9f99db066091fb7f

          SHA256

          00317a6d3639ae8fd257459e913e489d2a50c20c1a94ab27c02b3acf22db5f17

          SHA512

          f8cc4092b9cc6fd2a3ede58a6c18309a1397fa74edeac39bf793d7221def28ce221ca600579183877a5214aa0a5ca9d179c7ea8715998d9ec50927a6b01ae9e0

          Download Submit