Analysis
-
max time kernel
150s -
max time network
145s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
03-05-2024 01:34
General
-
Target
0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3.apk
-
Size
1.1MB
-
MD5
aaec5d207147fb4b4700c2e0b82b7272
-
SHA1
3b01954ea4e1a6488ce0f9a044b89fa513d2d3dd
-
SHA256
0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3
-
SHA512
9a622b83b03d8a723ff96fe7840899251767e22d2190ff043bbe57514afd72ca561c33e65b6f5924942b6ec67647f9d22ee66b726b8a1fd3543cb7ea9b5b445c
-
SSDEEP
24576:56KtLf51JR8li6FE+KTj8uKsZjheVlEz0P/mjyW3g/x/A1:NrezFEtTj8uKsAVA2/5W3g/y1
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.jejisinepebuxo.cunenu1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5725b9947cd79008fedff5f047d3b787d
SHA1c23683d372743ddcc0dc8b62cafef392c6a2ba10
SHA25681d29b5d2e1b127e7a9c1cc6a7748597742b2a3c564dfa3635152e7d4fcf89dc
SHA51236ac9200ffacf8c85defb527c36c804579afee563128d341ce6633e12226db1579694f534fedf7a20ad0b0882a9f8e6644078ed581c44a58df8534b0eadb479b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD515557c023ce676ace29bedec311cf94b
SHA1108c39d3e370eb09892287524f600a6f12372faf
SHA256c979664705982f754033445bbb5938b3f3ab816ac8e5f0f8a41f09acd187fe35
SHA5120e04b0e4314df0c05dc9ff15db2ae062e70647e72be728a63dc3bbff2c425832430ea8ec7796a821b4afc41df8be8a9924135b0b8c51332431a7abaf16e9d8af
-
Filesize
108KB
MD5838e96c462625ab4473b1e24728a1d70
SHA1864e72ecc080294f16bc323fb36f62b0b9339123
SHA25655473dc0506f134b9ee76c3c171649e73653541aed38539d8f63b6e05635c471
SHA512fa16c912d26f3ec1944eff469b091de683d1ff4681b3a0b8359335a0444c9f38e7f7220256a7545d5cad9779b3068fa27bba18bb3bf57237a75578994e38a7fa
-
Filesize
173KB
MD531d8050f43525296f0a54269eaa8491c
SHA193574e1e738ec1c99b3441d75f965b01d62db517
SHA2565f9ec1d2135385c4c284eb7492829142aa6178877b0fc744326db35731b18487
SHA512225677969e08e6b9ee145386a94e463fba093eefbe6023e3ce9657d3f92b6a65042dcbc70e242b0266ec79f57989b6e5b7f57fd3325745c926e82758f69a9a48