Analysis
-
max time kernel
148s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
20-03-2024 22:02
General
-
Target
206c7ef42f47e0ca6edc2db4e5754d6ccd07ab915aea849e05b1c136a73ceee8.apk
-
Size
3.5MB
-
MD5
515b179c5d1be69c73ebef0b63d92d92
-
SHA1
ab7aa1ad0f6b4c3f2ba8aee97e2f78ad3b75b646
-
SHA256
206c7ef42f47e0ca6edc2db4e5754d6ccd07ab915aea849e05b1c136a73ceee8
-
SHA512
c2c6315eab2ce575c8c80c750f0f1e8a7a6a7671c549dca8797e5db5651e884e2faa250678f5cf4cd711a19c82dc3d7ce20b122510d86b80bef141f0f9685646
-
SSDEEP
98304:+JyF7AlcUwUH6O6oVU3EHUWAjXv4BFkGV4PYwIoKAko2o:+0FcwADVU0HU3jwUKiYwbH
Malware Config
Extracted
hook
http://191.252.178.207:8082
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.karigaduvoto.leju1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51c8ec3196636630df1d52333d0e53303
SHA1be220f2b5c6173785ca8eeeef0729191ab8ee436
SHA25621430fba939096dad24e85cd4041fb72ad4f899b45576c98ec9b326676b752d0
SHA51225179f922eeffd6f95857e0bf88cf06853ca2ee6d270605384caa768457191ffeffdc994997016db69eeb1a9b79f58973bd419e9de2502aa5fdb4f7fd4454355
-
Filesize
16KB
MD56096d114f8583f9f5d8fc66ef36cb5f5
SHA1ac98f1a942f3e42077d35bbcc855ee92a6b9d4f3
SHA256000fef8b76c38ffafa7d47d6162ca101caa989672ad8b89b0e8d39f08025ff6f
SHA512fc1c0d7268a4fe88635d7484d7f1758e4b955ef7226f3f9d06277327a624bff2d8d5fd4ed48192d12327321e9d88f895a5dcfc0eefcc7961a429da395375214a
-
Filesize
173KB
MD552b740d4d167d61a6fa0a654e9416209
SHA1e879ed11f54d79b7c49f73b8cf3d3ac1969f4d34
SHA2563af954a63d3c403b88b2d4f22c7495610fc8e8d0b7aeb112f1b00648f8f4f3d0
SHA51225f8b12d76ef08e93058b0946e75d6779cffa1a16d3c118632eee66ffb5f8aef0ffb01041631a0681dafc2028feda4f612bd3b7c7c7630118d84dc8af8887620