Analysis
-
max time kernel
150s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
10-04-2024 22:03
General
-
Target
2332e3ae6a6661124bb0c8950820008228b414164bdf285e6f72b21eb5f8a993.apk
-
Size
2.8MB
-
MD5
8ba409dc270b99a9d3cf027131f6a3e8
-
SHA1
e1a56c0a7023aa3d046e04ce818a27f127986477
-
SHA256
2332e3ae6a6661124bb0c8950820008228b414164bdf285e6f72b21eb5f8a993
-
SHA512
acad52afc4e8dceae8e0202cbdf05270dec1ae136473fae3f7dd09c3ff26900c93ed0338da1f2a138abcace24693ce57ddd2c31a058befcf04dec0879c935d51
-
SSDEEP
49152:OB2icoHtrPki1US8fId8R9Ra9MIoImb+o3dm3PXEA3hnoXivlzp/Xnkg/fr:OB2icoNr91Zr8BTIopbBNmf0ACXIpX5r
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device.
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d49e0e1c6c3e6c795c61e1c7f5bb0ecf
SHA1671e6425ede2fdd786596aa5c4919c6825dd7588
SHA2566a1e534e611aea75c7a2f195e92b7ae3b69cdaa0272339d696994e6b4ac06807
SHA512f77dab76ea71c01e748992c14c10e9397bdbbe60f5bbdc57106c9bba23e6e6260a8f678d568198a45997cb4e4655bcd01e5f513eed687d89470ac4785ee595b3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5240057a7fa969223cfdb94bdb0055c98
SHA13370e500a07570cecd6fa756187c7347e03aeab4
SHA2562b4f3bd84f4cc24178ec4f00c05bc81e06121280cab4c79f8173db048cf5245e
SHA5122185744166ff7edb7e60be97c1d3de5ab39ea1ddb7afd25c9ac824ab597f04f0eb15893fdaec1ce11f6c85adfe7de8450c0cd71016a20dea193606f6b0f07cf5
-
Filesize
108KB
MD56564c9a719fdc04e9ed75fd6df38ed45
SHA17a50aa9bc9395d2f605197a00e9202205bc3c90c
SHA2565ef4dfc35f2d470b87492420dcef648bbae6de51052768cca89d7759abe15a90
SHA512f22423f25c288cad696078ee5b529cd1f7779ceed6a1266444225e9e47f06462556c7ed15ddfea69576c629c61f84abdf067254d1aa94ad8b00fdcf6ee2d8d95
-
Filesize
173KB
MD573bee3d2d142342b8b44df3a6b8f515c
SHA1221dba83ca259893c6f3e05d4abe1157a708bc0b
SHA256f268d2c9f962e3d1e9d5d052ccf1b89af41c1c9f9765448caca14b9611f5d995
SHA512aa20dbfa5b0378ae1bedb7ce3bed892f840626c14838dab15e4f5dcd96dc8b1f72cdc6e9a563676f62dac1f9c3f77e8c44e5c868ad3a697646ca254803218a04