Analysis
-
max time kernel
20s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
02-05-2024 00:53
General
-
Target
d44e53ca92e43d18e026f48ce295b02b.apk
-
Size
2.8MB
-
MD5
d44e53ca92e43d18e026f48ce295b02b
-
SHA1
eb924475a2b085bcc45e3109bf77886eede1126d
-
SHA256
bc0b22a27dc2865e3194c23a0555fb791a17da00ed8935b7d0a118262c786f0b
-
SHA512
ede5b7443b32fa71bcc9f9bcac540981a2755a2b5878033f0957683d33b0bceb5b2d4392fe5ba49e1911524a5f67a580aa3b97b258235c74e970751a1377ed56
-
SSDEEP
49152:G0mdqy656RS1b0R3FJLeISGmAchVJGa7Zff3y7GdfSU8QUOcv/pw6jg/RV3:G0mdqb6RwbSuhG9Uia7ZfPy6xSU8l/pm
Malware Config
Extracted
hook
http://54.36.113.159:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes
-
com.fisececitinoje.lalole1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a39ddc0e347f1130163544eb3d1e5497
SHA162245770584f25b5ee3c49adadfa977f48104915
SHA256e8a43d6d9715d90a75cf7651865db85dd35b7707f18f7e1d44ac3d18c6ed384f
SHA512d391bb2d8551a32e0b9a06fd3a55c91c0160cc0fcc9e5209f65abc5b788eb83a0de6613960e9998cf5820cf3a4008910a6663126465ac5bc9e001de9c411b4d7
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5febd9d6d29556f4ad58a3eddeba61351
SHA1df8a2abdcbfc0d95d61d8792bf9bc3c5874d12be
SHA25620b5473c1394e95ec79d63b3c5322ff5c4c392cafe44f913480e796df2f2bed3
SHA5120077b690eef87bdc4b67f0cda99e9381c748a7a93ae93c80cbfb0552e2558f9610bd140edf50944fdb4839a2ca05d8405dcd4cfd0b295a054b0c6057f228731b
-
Filesize
108KB
MD564f584d86ebae218ffdc7af6aaec8963
SHA1425f7ed401a925c9f6d2f7be9086274963c73c4f
SHA25602a7560ad85fdabf9bc9aede45ff80e190d700d38d5fa17d7241758fb82fd2bb
SHA512d30dfa61eee9496c7957e57b42090fa355e79eddfb60d9aa91e73e6a91d4a5c959a3a88efefaaf8949feb0556655602d1a375b11496bb18c078b47cf03fa1dd2
-
Filesize
173KB
MD557fb20b37454d5ba32276b53c742eb75
SHA17fccba8fd0756acfbc65b8b28221c7ea0bdde7e3
SHA256e0ecd814dc2562beb227abdd19ea9ac2d4418287597218d028bf20e35e81899e
SHA5122b3cadc65a35935f2c9c93de4df90a4944e7e9c7d9d278f39639ab8448fa1e71b89976dac07c2895202fda35f8a64430bd5dcb683e3ebb851a1af2afebfa6264