Analysis
-
max time kernel
146s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
30-04-2024 22:02
General
-
Target
8401f87e90c842c540c3298dcea49595bfc484da3de1a2696a809687ee59de75.apk
-
Size
4.0MB
-
MD5
de1b09e47afa84ddf55bfa3436d9769a
-
SHA1
34079f50ac7d78d800137adc4bf6e46faca90210
-
SHA256
8401f87e90c842c540c3298dcea49595bfc484da3de1a2696a809687ee59de75
-
SHA512
f1104f1f3197675633f656da0c726bd28eb79220a831a5eef3b3ac01fb148d79c98a07a3cd9f28dbd8062b87a58b88dac3654dd46bb41f41af0dc2242c190d01
-
SSDEEP
98304:kbOl88NNj1I/CLZjvVQRySr1pcdxkQp/p:tTNV1g6ZjteyAvkxJp/p
Malware Config
Extracted
hook
http://193.233.196.2:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.fihuxoyareru.xusopasu1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
705KB
MD5b4dbcc79515fd34149941e23ccd7629c
SHA10078fadccaae4a4816ae5ef5a90a9856a92e36a1
SHA2561462d6c7290475aa970e98a16c985553bb87f9ae62e51fb139baacd621e3e849
SHA5127e1fd6ebc0f4c31e0a42300673f2222a0a58816a431ed4c43160e164cc3eb63c96868a895ea37b363392d7f42eef8e53634e4515759694034edf1cf645e6384d
-
Filesize
705KB
MD5a31966ea78d532d01903c7d12cb64fd9
SHA14a75a010d4ec58c8cb06506f922e50043aa7a661
SHA256a9641805cf79c198615ce3bffdecf6ac680b1a867c52e37789e31bb415a5e5b2
SHA512381003f603b1f0549bac40233a9a0b23783639832cfe3ae57996f2646f0c5c417694e2e88102badc4f99773234dbbab5b17eaa54cf6082410cd9724fb8915e28
-
Filesize
3KB
MD56f9eec1daaa71ea2f5abe543f60c2d7b
SHA1ab7c086f9fcf63eb21a40794eb1dc6989d22081c
SHA256782393e2ad2a40cba394f21d750cef97b0c4fba6ddfe45c4b1a826de33041804
SHA5121f3ed7893ef50aa110ac4b58b76cd5c337910959700599461ff7dd051ae7a4173b44d41b7fa55012333719c846aac6d69db1e4e76e4dc6eee54de8a2df60ebb1
-
Filesize
3KB
MD58929c82a32d85ceffbadf421ed3d0597
SHA1d70d1f2ceccc0b18fcdd77c6e6f45c50a5da1a20
SHA2565d647ddba8f3791f89c0e5781d0b3d84dc6afae3f8e30e3e1340ce00a355d56f
SHA5129982c0e36a05a78a61de3286fb3a8ae5bda420f82f17f2bd331f63a3673cf30e55341b5b70b3da866822dd7075c654ae97b8e90719adc9eb9930306087967f40
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD59e52617e75b1f1acf063c5723c287e33
SHA156c260b19a29ba04f8f4303d84c65f85b0ffb7c4
SHA2569f7e1e20f5b1d9017de9f947b7d9b3c6b945c38257e8d833043bb2fd274b4887
SHA512de2fa836683585a6c0c3fe30821f1ae9cb32776aa3032283b2274267656d0b4654ea305fb04035deb6042c3a09cbedb8918877f009c511afe8e11505076bfd37
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54c1be5a69514f32d968c5549083f7672
SHA1364fb099f6156151acc9021e91be17af58d10100
SHA2568614425e3b9fbfc68ed7b9e4110d49dc6bca9de9d0f004bd231b6ce36c2fdde0
SHA5120a72dac98e2e1cf58642035979d3de8fa0edc3f87e15801fd7e21b1d6354ee540fa6b64a5fb59e18432f4e6f086e561dda96a418cf817827fa4790a81f848f84
-
Filesize
108KB
MD5b095126703a327532bc655f7090a6f38
SHA1892d04faa023016f6a34969dd9520a8b8f9bcfe2
SHA2569bcbdc5d328c37ae0fc18f07724503cc266cf0e69f6c503b46d2c68af82649c3
SHA512e5ecb04efb7874e5e4a2b2d44615580bd4f00f94ea89d6292101cea7a8c500750bbc2cb88af91b369b28479a6430e1d45ff8f0e5149cfaf771004e681bba73a1
-
Filesize
173KB
MD53a24ccd540140e34cd7b1d8ea89587d9
SHA14fa12dce60db8ac4fb701bf4827fc5b264c8aef0
SHA256be5fcb8ed9e38b2d91f30217673ee595ae405cac0a8024e6803f074aa4390b97
SHA512d3f744f4bdacceb8fbfc3597e7cf3996b60b8db91deb8f59ee57d7b238abf17448b4a217a4aa57f27eff38402dca8040477907abe30725390fe386542096b1c4
-
Filesize
1.5MB
MD53086665e8439a247fa1e1acf478009d6
SHA1ca6f455f0ff58a854cf06c22aefaa602f7a8d749
SHA25604536e1d865fe23c8b13920ad08bf986831e2adc65e459c64e1300667fbd8f0e
SHA512d7da1554bf91270fb907bc00dba4f30c1b487e990c624b68558c1932c6cf07b48847d50caa6b6e891431f9d5307d3274f205009f6b73fa748b76514174c62cc3