Analysis
-
max time kernel
152s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
02-05-2024 01:33
General
-
Target
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.apk
-
Size
1.1MB
-
MD5
e07fd729182650c77f29293c6e4522c5
-
SHA1
9e0c183e6ef61953cea9d29bf4fc6ea2cbd8a164
-
SHA256
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0
-
SHA512
8673e7b983773e58f83d4a75b7a7cc7dbb6d0bfcc16d47848800cd491fb224880e1867fe198ac35f3dec496f2154a5792539bfa2e27cb557336331379e86dca7
-
SSDEEP
24576:sbKs3t7YSbMlettFATgZYfw20V/ojyx5g/Qn2q:zW5YSRFATgyfw2E/Xx5g/7q
Malware Config
Extracted
hook
http://54.36.113.159:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.lexohiludulefu.jojuxewu1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD575adcc4c7823b8a733dd16661704b2d9
SHA164b0fcfdbe866b62ed7ff8fd5c4779d14e14c348
SHA256e3a8fb4f0a95c94b384cf951c9d8554f36ad7640f6717d77fc2afa8633bf0b63
SHA512064975f796555c371aa97140945891d5cacbbc3fc9f140eb8edc2c49c90160eb59f1b3704da54563556786474d4e8d30d387e5b2e0e37991fe0cf50d2b33a2f0
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54bd598803952696ab57e26a7f19f59db
SHA152dae9e7014ac57d4f729abb000d4d444477c5da
SHA256209ffcb35b0758a5ddcd8e32acb2689aa655c92f331f87c1df7389da27428358
SHA512e716409ec58911766eaf2c6aac2f01a9e482fc8b3857881e670119d29966c1ceb15c6a056f0a72f8d899ce5e2d1ddadac2f4c75df058c67596ec5505b9014777
-
Filesize
108KB
MD558fc2b04bbc8f091e355a9edf253e19e
SHA1a2380b3d9f2404b12092eb54615b081cf597b826
SHA25680d9db1a7015e067cdc6ac6863ca527b2f8d6044bf088a2aa0b56a84c7e05af1
SHA512cba833eb307b5016b23958a0365d91b0a4c805994df9c2ed7cc850e54a0e5aa72b1b5d76f28354467e6a205897901ba7489753df285d182f5a66b8ddadcb050f
-
Filesize
173KB
MD5fc9b5d301b9cd36b8c56f419e9ecd25e
SHA119a8e7819a54a0dd430b3d4f2096d024d8e9c50c
SHA256738e454ffd1090666b6802e69202e250654354963c1c5d4559db034fe850a337
SHA512262441fd46e7cc51c469ecf257e4dd2106a45e9d88c7065b30345578cb2575f5888a86f4c4b86db318ea24c079d66d114ca6f2624d34156fa6bd912129ed1023