General

  • Target

    d4ae2fca2e9b926ed00e143fe82d5a7a.zip

  • Size

    2.8MB

  • Sample

    240502-az7l3sdh93

  • MD5

    d4ae2fca2e9b926ed00e143fe82d5a7a

  • SHA1

    ec1adaff7cce6ad44a1ceea7b8e570b4a30e80cc

  • SHA256

    341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a

  • SHA512

    6b64668d1ce3cb2ed7642198300370b9ca91cd4df63add599b5202f798924a1b8d8c380408e7096ba8088ec544ae64be0a5a3ebc4da12cc5fe451a4c52303106

  • SSDEEP

    49152:VOzC9Y6YLY4KyrS7sHiV38ZyMf4fgxIIg9nqMUN3OmAtDdZnHIo/kKLg/VQ:VhY6YLYCrMbtaAfgxlg9nqMUZMZ5kbQ

Malware Config

Targets

    • Target

      d4ae2fca2e9b926ed00e143fe82d5a7a.zip

    • Size

      2.8MB

    • MD5

      d4ae2fca2e9b926ed00e143fe82d5a7a

    • SHA1

      ec1adaff7cce6ad44a1ceea7b8e570b4a30e80cc

    • SHA256

      341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a

    • SHA512

      6b64668d1ce3cb2ed7642198300370b9ca91cd4df63add599b5202f798924a1b8d8c380408e7096ba8088ec544ae64be0a5a3ebc4da12cc5fe451a4c52303106

    • SSDEEP

      49152:VOzC9Y6YLY4KyrS7sHiV38ZyMf4fgxIIg9nqMUN3OmAtDdZnHIo/kKLg/VQ:VhY6YLYCrMbtaAfgxlg9nqMUZMZ5kbQ

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Requests enabling of the accessibility settings.

    • Acquires the wake lock

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks