Analysis
-
max time kernel
151s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
01-04-2024 22:02
General
-
Target
c3091c704358f7b326543e9304499e2e5f1e27fcc43d84750c48fda232e37ee6.apk
-
Size
3.5MB
-
MD5
447868eb6480e83644df360ac8cb42ce
-
SHA1
500c2b6e50511afcfe385a68bc279d2549894abf
-
SHA256
c3091c704358f7b326543e9304499e2e5f1e27fcc43d84750c48fda232e37ee6
-
SHA512
f439c758ef63151d5b012479268dca13c63229dd6e2a064ad46da227aeb4621f0021e3135c02aec4c8ecb1580a955da2d47bb1cc614aa7ca0466027ed8d3a518
-
SSDEEP
98304:1B5GqqzNIClptDm9P6boJtD15qZ3O+BsaojFuf:HMLH3tqP6boJtjjqyI
Malware Config
Extracted
hook
http://137.184.228.202:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.vazefowocezaga.zice1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD56ffa86f417408ed22bdd6995327b9441
SHA178b0fdc6e8f433a6c926f6527293b50bd7b54c8f
SHA256555a60f1ec0acd72779bce99c6bb226c1e6ccd4e5edaad9ff9189b1defd35d35
SHA5122bd28092ed73b2303eceda22e3c66bb732ce5fddb83472459de578fcdfbb4a609e06926d383d991389b2d54dedc8fafec354959bdd35d75e2671c2e89b3cae02
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD512c0a8151a6db71317bdeb4b1633e719
SHA1cc90a5366c35718298010f04216ee59f4dd3aa0c
SHA25646a414c5820d90be8a973f31ec6ebf17c8cc2cf3ed9bda75e9a510aadc612e45
SHA512f4c87edb3f9684b0841ed54c12fb4fec595a6556996e13342633024408bb89b7429344a21883eefc5cb6eac99dd0381f84f0b1114e17afc5dab8d7c5a6c8b975
-
Filesize
108KB
MD5ec8de7c663251ad9cd49f657e0b5fe76
SHA13e9b566a3883cbd56d8ca6a9b113d3c5f4333760
SHA25604d3d2440a4cae280e2c4f33b165602ca659d06fd762791ae3573e7fa187b0d4
SHA512c83893e6a8d3a366d3c90833bdebeffb3a456f65ee709040cbbd6300d92f193573eb6805ca3baccab5cac13b85217278bb0f28725e4c84faaccaba90cd557d63
-
Filesize
173KB
MD5448879d18f999eac33fd856d9b66d412
SHA1c7fafae33b5fd5604f52fae31ab2aac0109af922
SHA25634fdee7ea64ecc98e6a5a58b44ec0508e6fada1f47789a69e0564826d33db00a
SHA5121336b6988a37a8ce15c5224fd7c22469a0361d4a59ba09142f3f567d9ca16aeee2ae004541cc994d42ba830e57a913c709e6d376173b960249a2506eb98260d1