Analysis
-
max time kernel
13s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
01-05-2024 19:35
General
-
Target
d44e53ca92e43d18e026f48ce295b02b.apk
-
Size
2.8MB
-
MD5
d44e53ca92e43d18e026f48ce295b02b
-
SHA1
eb924475a2b085bcc45e3109bf77886eede1126d
-
SHA256
bc0b22a27dc2865e3194c23a0555fb791a17da00ed8935b7d0a118262c786f0b
-
SHA512
ede5b7443b32fa71bcc9f9bcac540981a2755a2b5878033f0957683d33b0bceb5b2d4392fe5ba49e1911524a5f67a580aa3b97b258235c74e970751a1377ed56
-
SSDEEP
49152:G0mdqy656RS1b0R3FJLeISGmAchVJGa7Zff3y7GdfSU8QUOcv/pw6jg/RV3:G0mdqb6RwbSuhG9Uia7ZfPy6xSU8l/pm
Malware Config
Extracted
hook
http://54.36.113.159:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.fisececitinoje.lalole1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5155f340aee2e78679e66eb6b7a75633b
SHA15c1f54f3488741a0d1061fb3c15352e8d79d0089
SHA256544aab92eb66dd1f587cf67f13a8d356e3722edbed59a3543c3f998c8420ed36
SHA512f7aa5697148785257febbfb3b3f8b08c07fe8f52d8ee238778ede4fe844ac8a42d3dc88469daa70d468f7cccd84bf71b54bba2a69741a42f5c30d68e1405d0e9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5074cae41191d0dec2f3e87696227e53a
SHA183db5e3ab98de69a84ee7e99ef3cf7d81a1724f5
SHA256ac45931750e3399959629a85f699e1069b998de0d8e6128b04047acab2b9d083
SHA512ed217b2b0d447ce4ed3ed11108b0a484f6d93518d17f17c83955fc8e10bb7300b718dd5f6325679787a169908808e52866e78fcb979e9bd4f61869d97e869855
-
Filesize
108KB
MD50935496ff9eebd2503d6fc5836f04b8c
SHA13d424c0f9cf88a41d84a824825c9016ea72d5fbf
SHA256c10eb51811e4de23f37e5dcfa5d418f70c7ef398243bdd244f25b7423ad7e069
SHA512cffdf01edd80cbf17974d246c310542bb34e21f2e8d6feca35a45bf64ed4076195c8b9c320224713825caf521567f3d38a9ffd77c603247be105a1b36a2dc15d
-
Filesize
173KB
MD5f75df876c0fac5a010df7ed9447d6bb5
SHA1fdea36209dc2b469bf6ee2ea24c66cc63c5583bf
SHA25610a23280e00ee676b3b53c814b906eae40a2ad221f74139fa3a8eeafd096fbaf
SHA512a0871a3414d9f14ccc8fa7bf99c22e278e334207f4d36284c4e34309401292b4d8f8b4b66873054889608af12c4a3c71e182726e19cb7c8d780dd1dad90d3d88