Analysis
-
max time kernel
153s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
01-04-2024 22:02
General
-
Target
c3091c704358f7b326543e9304499e2e5f1e27fcc43d84750c48fda232e37ee6.apk
-
Size
3.5MB
-
MD5
447868eb6480e83644df360ac8cb42ce
-
SHA1
500c2b6e50511afcfe385a68bc279d2549894abf
-
SHA256
c3091c704358f7b326543e9304499e2e5f1e27fcc43d84750c48fda232e37ee6
-
SHA512
f439c758ef63151d5b012479268dca13c63229dd6e2a064ad46da227aeb4621f0021e3135c02aec4c8ecb1580a955da2d47bb1cc614aa7ca0466027ed8d3a518
-
SSDEEP
98304:1B5GqqzNIClptDm9P6boJtD15qZ3O+BsaojFuf:HMLH3tqP6boJtjjqyI
Malware Config
Extracted
hook
http://137.184.228.202:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.vazefowocezaga.zice1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f110ea0c0f4b9dd31c9551f0c7f16647
SHA13b359a9efe8eacfa6cb2dba39331ff09ee18b12e
SHA256d2147d267b04b893388536cf687518d3109f1ee212e883466dc91a0a9fd6c7bb
SHA51232d78b5c8220a01810eeb9463315d1983b4eb8b5284de8be592e99fd850de0fa6c1bef28fdfb9a3763947f047263e39859d95dd4d26e75f5546d1a6c9cd4ce41
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD52bd6c20cda60ba212d40410eec62fd61
SHA1c23d34a9b1397563897a37dab6833dfcc477d822
SHA256f1e201cbfc26753138aebcf8d28738abdc1253c3f7fd1e00a9c718a8abeaab5c
SHA5124f4d11f4662eac6c1ecc40c755c290dba6d0afd34651649c524e132d0858e1180262ce9aaf17d321edd4c3462f0b9c11a09066f3b300f6c0377bc7cd106b9323
-
Filesize
108KB
MD56a74221ce117babb014a646c3e861427
SHA100872e66d99059f56b0142b1d5b48134c96380d0
SHA256bd8e27d32437bdd3527ea072b16a63d6031a28f2df44f32469afdcefa06956b6
SHA5127373abd2d34467cf7db9f7e89d50d4119bdf4f92d77bf2d769ef2fd9a56248374b5781902d5db58ed0644b2373234d10d8c64692d4d81f89dc5589167ba098ab
-
Filesize
173KB
MD56ee7f940846189675f7b696174563b24
SHA1d376154a1ef484b8f07816c2725a558a254abc36
SHA256fcb4e1c69b0020824650cebed1ad65ed8e1a2569c28532f1f735dd2697abb048
SHA5128527928256e2a8859be96a6a6ed3fb955dc878cd83c60d12f673e1e8ea2af169f8d3a10b5b5028a7d421f29e1ef2b48bd2119c249bd3e4c73a5718d8fc479608