Analysis
-
max time kernel
150s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
01-05-2024 19:27
General
-
Target
aaec5d207147fb4b4700c2e0b82b7272.apk
-
Size
1.1MB
-
MD5
aaec5d207147fb4b4700c2e0b82b7272
-
SHA1
3b01954ea4e1a6488ce0f9a044b89fa513d2d3dd
-
SHA256
0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3
-
SHA512
9a622b83b03d8a723ff96fe7840899251767e22d2190ff043bbe57514afd72ca561c33e65b6f5924942b6ec67647f9d22ee66b726b8a1fd3543cb7ea9b5b445c
-
SSDEEP
24576:56KtLf51JR8li6FE+KTj8uKsZjheVlEz0P/mjyW3g/x/A1:NrezFEtTj8uKsAVA2/5W3g/y1
Malware Config
Extracted
hook
http://103.67.163.33:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.jejisinepebuxo.cunenu1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5bab45c3eb0c3961c9ecfa0002785baaf
SHA151480a3b9629672f47bedc9dae30121277d7dc48
SHA256871ce5a0df34de11b29036019388162111a42cff0f53eb71c3efd4590ba733f3
SHA512151ebc9d4d6122c215df094ec16dfa2c0ddcf2148cf9a1002e8f7938860460698649fc8be25f1c473233c9bc6f3a41f41d766444a7257022246d22123fc46fd5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5094c7dee289db94ee65fdabb79fa0b39
SHA13aaef986530a45cc0575b95b2d9bd390c8ca73de
SHA25693b136c6bdd392a53ff4b48711597a48b9b403faaa98e63907923fac4a993937
SHA512864c79f4913ee76e50c33573bb37c264e6d8b93e8373441f828aaefb068b2ab7611ccd42e81c17690e284ab5146037e6ecad393336deb7f3214c4539cfb0873b
-
Filesize
108KB
MD56b2d9afacdb08216fb1b0f59b83d99e7
SHA183056624e9b04194963e7341178dc68bed49f383
SHA25668354c6481669f07defce1ac7b8461cf1bbecfb4a9a807f7a58934e0668996d3
SHA512314641de4b90e264a91c204fbdd015d72ec789b98058f2c818b73975f60a2c2cf713164207865fa418b705e33d61d17e91e5f2d6646bd778cc15496f69dd1272
-
Filesize
173KB
MD5ea1eb98b20e21102741d2e3140808176
SHA1c8a9e727de77235fb105a69c1259770a3e5f9fdc
SHA25621fdfc81ca48ff03782947a4f63170d435352d7c7c550170c005de58c0921578
SHA51237ddb48ce4d591585ff848166854fa4b508aba5c17d6d22feae18467dbba2e655500f692b1ff9a443860f1c69c71d2201212db7bb3f41947e37be778f7dcf171