Analysis
-
max time kernel
150s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
03-05-2024 01:41
General
-
Target
bc0b22a27dc2865e3194c23a0555fb791a17da00ed8935b7d0a118262c786f0b.apk
-
Size
2.8MB
-
MD5
d44e53ca92e43d18e026f48ce295b02b
-
SHA1
eb924475a2b085bcc45e3109bf77886eede1126d
-
SHA256
bc0b22a27dc2865e3194c23a0555fb791a17da00ed8935b7d0a118262c786f0b
-
SHA512
ede5b7443b32fa71bcc9f9bcac540981a2755a2b5878033f0957683d33b0bceb5b2d4392fe5ba49e1911524a5f67a580aa3b97b258235c74e970751a1377ed56
-
SSDEEP
49152:G0mdqy656RS1b0R3FJLeISGmAchVJGa7Zff3y7GdfSU8QUOcv/pw6jg/RV3:G0mdqb6RwbSuhG9Uia7ZfPy6xSU8l/pm
Malware Config
Extracted
hook
http://54.36.113.159:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.fisececitinoje.lalole1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD549b69e5f1bf84af6a7b82c38401de339
SHA16bf8b460705e06dbbd0ecfe6d383f18d3c9cb999
SHA256367fae7185ff7c7eb5584a97f69aaf3e7e635f94dd676dca57e4a0a20b82be44
SHA512f12b39d5fb1eae27861637513be4557cdd1ba24444d3ae2f9d72a22142b450e5e150e15cbef1341997d5e0a72d10396eb9de89a8bf4575cb00a12100311afd57
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD51e7056034f4acd1de90b74bb8249f9af
SHA17011d0f6f7a69561c754f9288dd41c117238483a
SHA2569bf1ee2b2e89d36495442ccda8edb0855fc69a3f06352ad2aca7d6a1570bce11
SHA512ba0e76f48836256d3b16c0c1b1ab062c916ec3c08a0a52a3c22b1bcaea3de51cd8ac9de7cda334ef76c242359c00f5a0170eb85bc1747a6d2219d7325a788930
-
Filesize
108KB
MD54b4aae16240e906d1a4f8ab503782df8
SHA182987e3cb39fd78d318c6775f5466dfb1e0712fb
SHA2565603424ccee9be748310a2ae97c28214b295b0851c2bb28829e264b532e8a039
SHA512c4d7d9ec4f3087824568ea976948169182a753be891db9144572a66b69b2cc9e2cc97f187b4327dc645d149d27d72c2e479c3d33ccbd817b992682eee5ef2699
-
Filesize
173KB
MD5ffd9f7ab122ebd747186afd64de67870
SHA10a7b4bc2bc6717cbc7c22570557f23328bc80b49
SHA2562920314720a8c41c4182fa38e449ce2df223f682e6d52bc4dfdef0ac83768ecc
SHA512d61714592cc89a67a1a0e44e69e37fa173cf5f038c1b9c12e7c9856ba7ff5fcdced730ce32b1793d3babf673b31bd6fb592cf5642d6068f63bc989fcd1054f2f