Analysis
-
max time kernel
64s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
02-05-2024 01:02
General
-
Target
0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3.apk
-
Size
1.1MB
-
MD5
aaec5d207147fb4b4700c2e0b82b7272
-
SHA1
3b01954ea4e1a6488ce0f9a044b89fa513d2d3dd
-
SHA256
0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3
-
SHA512
9a622b83b03d8a723ff96fe7840899251767e22d2190ff043bbe57514afd72ca561c33e65b6f5924942b6ec67647f9d22ee66b726b8a1fd3543cb7ea9b5b445c
-
SSDEEP
24576:56KtLf51JR8li6FE+KTj8uKsZjheVlEz0P/mjyW3g/x/A1:NrezFEtTj8uKsAVA2/5W3g/y1
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.jejisinepebuxo.cunenu1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f6445a8ba4294f641d8119ad1fbeb52c
SHA1bdaa5a939b80aec604c58f5a50e75ad4cf79a981
SHA2562731ff6e1ddc9d0ed19c5456fc6ef43b792fac3b0a317d12a9ef321842fc1e64
SHA51241fa5c55b7e08eaa04d841346794fa809914c8a92f0d199bc1423e6d4ab1c2eeb5ab69fcbecf021302315c2b05e9ca4e1d9248f8768c1223b76e840039d5ffdf
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD59f287c28333c315141093163ecd7f6a3
SHA142ad64df4b1432daffd43d5e7c6426a9dc428da6
SHA25675f6b96a5485405ae658d945039c3f0ebd97b83e01c6a0b54e374b5c21f9b0c0
SHA512b74213e518d7adaded26b980a1b4a039f39d98a1acfcf1b399d06a921d2fa881c35df46c73d97d95baaec3bd48aeb48622a301e226d1f4a4ad7b0a5974efbc6c
-
Filesize
108KB
MD56a9263e6ec7776d7c5e8673358c304d2
SHA169f99c2b711cae99245861e8b6d3772fc0cba406
SHA256fedca88331a9a6a89dbdfa7557313a15aa15cbb5cfc2e8dfc97a31d282683234
SHA512e45407dae981ecc53832380d90e7ea080ce14e2e8ba5cf0740dad84acd7f2e9a16454481dcd8f4ebf73d7af9f5f47b53ea5b88ea058578ce19d203ab8b855941
-
Filesize
173KB
MD5cc893e63ed117147f246c046b9a44bc4
SHA1b6591703baea1fbf4371381040cac645ddb067dc
SHA25660c414e9513db5ea1ce07d9183d6e811a1b279e97b128f2f1303fb291a61928f
SHA51276abb81d58253dd4524553e13997a24eac97932f24a656b0a2320e845500e616edbcea7664434e2ce885c387b491e7c9cc836d25ea8494f5f3cb4084f6241ae5