General
-
Target
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a.zip
-
Size
2.8MB
-
Sample
240502-bme7qscf8z
-
MD5
d4ae2fca2e9b926ed00e143fe82d5a7a
-
SHA1
ec1adaff7cce6ad44a1ceea7b8e570b4a30e80cc
-
SHA256
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a
-
SHA512
6b64668d1ce3cb2ed7642198300370b9ca91cd4df63add599b5202f798924a1b8d8c380408e7096ba8088ec544ae64be0a5a3ebc4da12cc5fe451a4c52303106
-
SSDEEP
49152:VOzC9Y6YLY4KyrS7sHiV38ZyMf4fgxIIg9nqMUN3OmAtDdZnHIo/kKLg/VQ:VhY6YLYCrMbtaAfgxlg9nqMUZMZ5kbQ
Behavioral task
behavioral1
Sample
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a.apk
Resource
android-x64-arm64-20240221-en
Malware Config
Targets
-
-
Target
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a.zip
-
Size
2.8MB
-
MD5
d4ae2fca2e9b926ed00e143fe82d5a7a
-
SHA1
ec1adaff7cce6ad44a1ceea7b8e570b4a30e80cc
-
SHA256
341c5b8d7fda09706c39fdb959897e9a983f25bb06cfa9b1a96fbfe54854086a
-
SHA512
6b64668d1ce3cb2ed7642198300370b9ca91cd4df63add599b5202f798924a1b8d8c380408e7096ba8088ec544ae64be0a5a3ebc4da12cc5fe451a4c52303106
-
SSDEEP
49152:VOzC9Y6YLY4KyrS7sHiV38ZyMf4fgxIIg9nqMUN3OmAtDdZnHIo/kKLg/VQ:VhY6YLYCrMbtaAfgxlg9nqMUZMZ5kbQ
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Queries the phone number (MSISDN for GSM devices)
-
Registers a broadcast receiver at runtime (usually for listening for system events)
-
Requests enabling of the accessibility settings.
-
Acquires the wake lock
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1