Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
190s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
23/05/2024, 22:04
Behavioral task
behavioral1
Sample
923bc65bf07815b0b2723ab6cde35887c61d665baf6618ce4e1dacd6345669ad.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
923bc65bf07815b0b2723ab6cde35887c61d665baf6618ce4e1dacd6345669ad.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
923bc65bf07815b0b2723ab6cde35887c61d665baf6618ce4e1dacd6345669ad.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
923bc65bf07815b0b2723ab6cde35887c61d665baf6618ce4e1dacd6345669ad.apk
-
Size
2.8MB
-
MD5
899022727c1eed901d9e847a44f017a0
-
SHA1
27231e81607121522405a98dca3c4efe013d6282
-
SHA256
923bc65bf07815b0b2723ab6cde35887c61d665baf6618ce4e1dacd6345669ad
-
SHA512
9f3b4b6eb7690c2b688b138d3301f13d320b45832013df366b1743e3b722bd8a42e2746ed4d43e028de0df92f7eca3fce55a970102dbb25431ad67f5ff2796cd
-
SSDEEP
49152:1KYIc3gRcXBxxytSOLAQniVL5TC1/cGypQqgg9TKAzwXhcHh8xngteZQpy/XyNgl:41xRCNnmFadTC10G4QWiXhWiKtyxXYk
Malware Config
Extracted
hook
http://185.208.158.109:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tencent.mm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
pid Process 5113 com.tencent.mm -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.tencent.mm -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.tencent.mm -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tencent.mm -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tencent.mm -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.tencent.mm -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.tencent.mm -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tencent.mm
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5113
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b149796a334a5dcef4821bdf2276982a
SHA1abed865b6ec6a579bf2aaebcbb8dccf3ad869944
SHA2566b888540e1944c1f82ff60af9c561d20ae3c320b706222491bb4719b1a9b04e7
SHA51290d707264d2bbc131aeac6b8744bd0aedb37b163e468fb940d01786144e6f5d77ca19742344a09fb81791cef57a23712f186ed0d83ce574dd117654920a20297
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5235f3abbde36f670deda67bec521f7d4
SHA10e48659b3af93ac56c84a48cb32c59410bed6f90
SHA256e98919ef3b6e33b11d94ecfeae9776230a544c2023dba69158b7ceecb74ec20c
SHA51237dffb55b7ecfb24db5620555205ecf1cd20e801c3cb86a58159b311fb1180c7868b79d38c48aea8a0d673339cb91d829b7ba4c682e4c995989b70ca0f3b59fd
-
Filesize
108KB
MD5c33ff13a11e2bfe059336ea3359a3b9a
SHA1be3ee6262716de3af822d9eea9a02039a8095bd6
SHA2565304e3c3b2a86652a3858f66b7056236a3047544e1e0f949eb95d727c4941e83
SHA5127aedcc9fe927577b591b520d0d260ab1151c6eea8294170f97909c8c79fe80411d0d3edbd6467ad97fe3a981c00ec31c0064559fc4a8980a951da1bded932d5a
-
Filesize
173KB
MD5dde00311d322140fabbbb7c59679267c
SHA197248c840e79303d1b030067ba3a224a656a6fcc
SHA25638b9ed16f20fea43a700d16922e387d0006336cd0aa46ae80e6e147676350b1a
SHA5123f58414ac30f398f3ff709e960e45a631b254baf625a31137a7d9cf4e39ce68006d132e38e0970bc2bc76eeac635f87ae6771d3c87bdee17a58753c26163a030