Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system -
submitted
03/05/2024, 01:49
Behavioral task
behavioral1
Sample
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.apk
-
Size
1.1MB
-
MD5
e07fd729182650c77f29293c6e4522c5
-
SHA1
9e0c183e6ef61953cea9d29bf4fc6ea2cbd8a164
-
SHA256
697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0
-
SHA512
8673e7b983773e58f83d4a75b7a7cc7dbb6d0bfcc16d47848800cd491fb224880e1867fe198ac35f3dec496f2154a5792539bfa2e27cb557336331379e86dca7
-
SSDEEP
24576:sbKs3t7YSbMlettFATgZYfw20V/ojyx5g/Qn2q:zW5YSRFATgyfw2E/Xx5g/7q
Malware Config
Extracted
hook
http://54.36.113.159:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.lexohiludulefu.jojuxewu Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.lexohiludulefu.jojuxewu Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.lexohiludulefu.jojuxewu -
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.lexohiludulefu.jojuxewu -
pid Process 4427 com.lexohiludulefu.jojuxewu -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.lexohiludulefu.jojuxewu -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.lexohiludulefu.jojuxewu -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lexohiludulefu.jojuxewu -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.lexohiludulefu.jojuxewu -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.lexohiludulefu.jojuxewu -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.lexohiludulefu.jojuxewu -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.lexohiludulefu.jojuxewu
Processes
-
com.lexohiludulefu.jojuxewu1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Schedules tasks to execute at a specified time
PID:4427
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD54cb6c06ed12de76dbb12f0f7a2fd6356
SHA12b517cbc39c5270765d9a6f7df6079cf94332589
SHA256e341fb44b7d588d30b7d4827d7c3b1a1a1099d0afdd1a1739a0da663056d31eb
SHA5124989dc91c92ebb0f88d843777cd8703768afde5fea3043279cea954ad94b16c0af0d305dd30e9d7bd84d470a41d74e97bf81d6e8a550f2a6a537e3b90a4f3ebb
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD51ed6ce67bc8b68c89aeb5b3a308d1790
SHA1957a97bd5220e738f56053960df2c3508d8e28bb
SHA25691afbb1eedd45f11d7e1c995c1405622381bf72489d63b81c172dba38feebbfe
SHA5121bea9094f27fee4eefde57463da99a85e17305ba1c01a3050fd1b297f4c1ebb4d10335637d1b43e18e259c8bbc82389a5518e00146a185e85be60e8d59c70217
-
Filesize
108KB
MD59c0a58b426013bd8c431fa8528cc56eb
SHA10917c1888da04bbc757e1e49f1186a0e4551ad96
SHA25643f8d8d0fa0235e2ff62e7a52815a9a3cace833cede5ae70d957773e2443d010
SHA5120ce070cf241258cc0b9a1984a4ec5afd9c209f2c86569759203fe20e5b2b2874dceafecb8518fb7c07449e09ece12878e924147d694798c0baf2549dbc1cbad7
-
Filesize
173KB
MD5f521fe0b70b1c00c082a7c261949d800
SHA13c5814b68b27289ad6a34cf58ed602fb88ba6177
SHA2568d7bd1852743f06f85ca6b592bf880fad93aa42c12c33cf7ff424e203a595ce9
SHA512863f8198f823b07523f1aabd368ffb42916c25f1cf58a1e7f9510a7ca579506e5854267de21e47451ede8257b4dc85b2cdb547959d41b512eb875c94f4e2d874