Analysis
-
max time kernel
150s -
max time network
140s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
02-05-2024 01:33
General
-
Target
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.apk
-
Size
1.1MB
-
MD5
e07fd729182650c77f29293c6e4522c5
-
SHA1
9e0c183e6ef61953cea9d29bf4fc6ea2cbd8a164
-
SHA256
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0
-
SHA512
8673e7b983773e58f83d4a75b7a7cc7dbb6d0bfcc16d47848800cd491fb224880e1867fe198ac35f3dec496f2154a5792539bfa2e27cb557336331379e86dca7
-
SSDEEP
24576:sbKs3t7YSbMlettFATgZYfw20V/ojyx5g/Qn2q:zW5YSRFATgyfw2E/Xx5g/7q
Malware Config
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.lexohiludulefu.jojuxewu1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d0663d99f12265a241149a8ae3789990
SHA1d08223ec8a92eb9ee5f5701415b2c3eb5c4eb616
SHA2566c48c6225bd37eeb3b9772e51457cc3f7f1db175fdbcd9ab9339d81af03fb960
SHA512e68cda5a845d1c77f7f3e61cae4efb44282f55c6567ee39e1a1cd64ba48fc2acab1c0ba401e6fbac6b6915e52fc630410ec142fd2f639b8cf44976073ccef773
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD508304c8933c5a0d83b5543b068497b0b
SHA16e09eeb0fb3a9b1d69ab67ec2fcceee9cf1181cb
SHA2569ba103644342f8d97fa47e72c795db46a8e94659c78c1b10b509861449529b7e
SHA512426189ff6b818ff5f989bddd0a6c3970d1715b3bc36e446bbc7583c9f88fed1072576d2404487133b9a3a4cf3fcfec2519852383f1307edcafa4412d4bd2a009
-
Filesize
108KB
MD5347f680116a201f669312214f5f59f18
SHA1056f6cd1df5ad3b353f509416bcb92a29e9e4cdd
SHA256a91f409cdbacbbcb783b6b5fd9f0b02d47b2a8a194c3b14593074b2280ecbd17
SHA5124743089271a85b21e6f16a1ca438423dd0eee8b15b16aa35578cc716bffb7fdcbd55fd473b1ebf34cd829f8535fac93b5e728ad9e2e835f615917a526c6e42be
-
Filesize
173KB
MD59fc3bd8b7124c0c8c376eb6e7eda1a64
SHA1e7805a920b2ca32c1c2f4f6373be734095ff23c8
SHA256a8983d54c78a3fd177714192a40e3f7680b79b3209481670f654a1e6e2a5530c
SHA512b9dda57f2f73045faf236311eca7c12a5413fed23186b26fc484fb8fb5e4e9c99038bd288fd3768c77df511682a317bb56729e7a30b944a1634ba063e3828115