Analysis
-
max time kernel
154s -
max time network
147s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
01-05-2024 22:01
General
-
Target
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a.apk
-
Size
2.8MB
-
MD5
d4ae2fca2e9b926ed00e143fe82d5a7a
-
SHA1
ec1adaff7cce6ad44a1ceea7b8e570b4a30e80cc
-
SHA256
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a
-
SHA512
6b64668d1ce3cb2ed7642198300370b9ca91cd4df63add599b5202f798924a1b8d8c380408e7096ba8088ec544ae64be0a5a3ebc4da12cc5fe451a4c52303106
-
SSDEEP
49152:VOzC9Y6YLY4KyrS7sHiV38ZyMf4fgxIIg9nqMUN3OmAtDdZnHIo/kKLg/VQ:VhY6YLYCrMbtaAfgxlg9nqMUZMZ5kbQ
Malware Config
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.weruzepufalo.mavimibe1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD55f2690866b1545937ab5c545df6b45fe
SHA163f5dd44f12fb37324d4388270d2f97cf95e479c
SHA256cea784d05a094734ef97bc902de560a464b73577f087a30a52cc6335e1e43e77
SHA512d6690ef5c3171db0b0a22c5c4b3fb8b8f8864c0380031885326e888a53d6af5957eae243caffbfafbcdab04e8123f7ebcde9c579120fbb1ef759f3f2cc3eae0b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5946337da1741aa3b5e5f5ca8c28b329b
SHA18a87fc90142157c2b459adb8d0d0754c5ee36167
SHA256d348a47d4951a3fd32465c6723bfec59aa62f017d02e56176259ac1c20d94f6b
SHA5129e769ffc07179c9a3724efbdc2755dddd9b3e4de04bc9584e9adf61784f7a2ed3a6c5b9ca24607c280ca651496b9c4ea4650bdbed49f83f16dbf364372286cb8
-
Filesize
108KB
MD5e58d7da760783bdc2068f8e462806731
SHA18bb0bb6450ebeaa1b54a321290b72f0efb2f32f9
SHA256e34318fde3c6d2b4901d0e3d39cb8f342e0d6a76492c76d68aceb2e511fc89a0
SHA512bbca14c20a5693fd0f70a7855710fd6f2b6b0b97330b9d1b403ccfc60423e37ff32d750f1e2b551444a6bf46a719476c7460ead443821226b5947f505889a2fe
-
Filesize
173KB
MD501073f28b25b9614f803cea988a06f11
SHA1a6e58e02cb27185afaf58b35c342c58bd4e548a9
SHA256f00d736e18a502bb27c3b0a739edbb203d9fa3151b25e77d51ff2b681968a45f
SHA512ca058637413e64c5094ff08e0349a07b653f7bc19ecbd8130ee0738e93ac5def69707d7e407d8f230c56e3571be0e04b68a954421bf59b170fbddde7b5809192