Analysis
-
max time kernel
148s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
01-05-2024 22:01
General
-
Target
a68281c33408fd04d6ff24bbaa2df6935ada43d1d6e73189a8194ba3fbd527b5.apk
-
Size
2.8MB
-
MD5
a10c88c3486329a3677ea4bb80e2284b
-
SHA1
be03b6866607b54f05a5661325660f7a5161dbc3
-
SHA256
a68281c33408fd04d6ff24bbaa2df6935ada43d1d6e73189a8194ba3fbd527b5
-
SHA512
a1bd58587c3ed5b31ffe891ed32a32a3b88d1b61160ef52681f0013c6a67d5ad7a54489a4ece012fa0c03283f7b931c2168fa7f7ccbed995e5793dd6bdc6814a
-
SSDEEP
49152:iTIBfxPaeHGCSMaWZSWrqFZ9/oCpM+zfzXdQAxRVujyJS+T0q7qfQyR+6ttrRw:iT+fxPaeH0B1VrGiRVUyw54yE
Malware Config
Extracted
hook
http://176.100.42.11:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.wirigacetoze.yuwazu1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wirigacetoze.yuwazu/app_DynamicOptDex/PKYxWX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.wirigacetoze.yuwazu/app_DynamicOptDex/oat/x86/PKYxWX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
705KB
MD5758f2306a80b4f1fb18ebb52abf5694d
SHA1dc006c95d0ccb09c1c6ec9da72ce32ec8299f7fa
SHA2569067c8538c67eaee28346cec3e222f39ed32bb9e08e7b22d12962516f61a9222
SHA512fcf5f1c5fae54337ea32c95b544358bb6cc380e02ac37e12331d94c1f483744216dd81e1cd80c63f0fb2f36b3c6361e35e510474f8fd8e55438639e7ba051267
-
Filesize
705KB
MD5df058f1ae6a32a19f50a213fa8774804
SHA1ee6ee53975b57756fd86bb6bffe83ae8d581e252
SHA2563a18c67faf537283e187310614d6acef46c4392f7a33520da3419dfb1633b8a2
SHA512afd9502c7f29e3ce97b4888aabd33d24443dcbf38b87c03a27c634fdce74c700d10b4c5788db4eb27ab2808e4f6fee862ad2f5b50277adde96575a2168b8e3cc
-
Filesize
2KB
MD53b73623405f1c625a4207d88f58af6c6
SHA1eb4f77560fcfaa5f18df4d9085c9dca981310a13
SHA256ea234bc91291f7185fab2570d8903de85412fe57108eb67bb2a50202382be45f
SHA512734690daf48e622ddd875e74bcf6cd0f59900a5188aec2c9d73e8ac2748560a7957f0bdde698d77a6bd8400737f919897f4553acd56f76c43328dba90738bd6e
-
Filesize
3KB
MD54fd10885c809d5f36f2590091b1f4f2c
SHA10362a912eb4648e833c063c48b15091d98520cc5
SHA2563be512999725667ef77dddc77af1f0b9d310d53978cd60415cd01974fe6f4f98
SHA51228f6039b08cf8e5a1d3c2613b3e7f48f28ba206e29d063282b4c3d2122510e4d1535ed131be3a0c6b720b03d40f93cdf78ae7ca05546933010f66fc6f82facaa
-
Filesize
3KB
MD5a368127851aaf1d82d54d4dac6a80f54
SHA1994ab74456b76086ddc788c84bc4864444cb71c3
SHA256966a0cb50f1aa059524ea06fd31cd3be7c379ce54ee0757bc558358062cbb8de
SHA51282265c02897aaaf545245741842ed1689244b84eb3242b20eb92b3b6e665f47198dc7851b7e2baf2d3a6d380dfb7a23579e0fdb923776613bff77af1784c627b
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5015e409b030344d0ef628a395ec213cb
SHA1e341b03e348d71a797b4ef3f961855cbe7324195
SHA256f6de34403afd328fab7bacd23a83680e6ff1c1a5b21e8bb74ff851bd5da3fb5c
SHA5129fa4adbc1f41832d9164ed17413b76b373811ecd70b61fb785218a67ab23e087b4b638ace09d00ffdf1083c594755a1e1abddd4c304b2e606d0d19e352d0bb9b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD53c373450216f246204b9d1caccff5edd
SHA1ffaefe7d451041b66523855fd618369dcf482d7a
SHA256f3175927401205274adc4c264602a94027e4fda21b187ad7d7de2b7c858ee95c
SHA512ea3b719348ac1ef798fc82985bbd16027221bb24a9adc0cd57c87978e30abbd2c6aedcaa2509fa442117cddfb3a150c2a9db22573355fa147304f4a555146f22
-
Filesize
173KB
MD58badf0f8da69ba1c1e331a34c51279ed
SHA1d2f06a63d7f85698a7c85c291fb2a57007d93f73
SHA25685e7ae7f3b6d2864954b2c7b7677f310d70561c7e829e2a2fb7c18118ffa331f
SHA512b4895613814b0abcfdd1e9ec1520abe0f91bec448f0eaf61c86bdf54f031ea42072a7d5a8f1435403370424950143ef0521be20264071212a10d70782158e354
-
Filesize
16KB
MD5fd3c7773e7ae2294535f1f8a4c73f655
SHA16b636d02bbd43f612c28b609a43d83abba51a980
SHA2568100ae2ab8293e8f5532e2915c52ba1633a56ac882f7e5e0512f202c40fe6e3c
SHA512a3947e447d8907aa891d2856a69b0b8aa80bf334daa8bc97bf94bb2b3f80471a07ba52a5ea319f20fd8ed63f6b482cd9c4c4fb3d7136d1b07bf97c651a61dd9c
-
Filesize
1.5MB
MD59e3001c0619a77686a820114ffcfccbe
SHA1111e731a90cd75fc479f3dd87578b161c4f3c907
SHA25661ce0d98306e47962a2f39b1978325c5a4cff2a8c32ba3ede38f5a5cd337cdcb
SHA512b99775c55138edda24a6c020c702e3778a97ca7c0f10aa02f6149b61a4d13835a1e66fa22c0f59e4f5d56edc44b933aaf9cadc0130e40cbfe62fd562f54b4d8b
-
Filesize
1.5MB
MD5625f582689b89479997507f9805e6f4a
SHA10f98b131a7ab157d319c4cbc0443cb3726993706
SHA2567ee6e8208623447487d48a3a0d476826e470718baf81cbac74eef2f4d50499ff
SHA5123d1d36de17e37d5861d9a83de01b0b3b9509c41b3f1cf1954b404e149a65cc37fd209a458140e7877795c9448d61d050051b615d461bdb53d32a57b6fc322211