Analysis
-
max time kernel
178s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
15-06-2024 22:07
General
-
Target
2d19cbdd421ebf5024a12f4380d870d127a8b9348d7ababcced56c1bb8702956.apk
-
Size
1.5MB
-
MD5
b8a90d312d6d9acaa2ebcec019968126
-
SHA1
558dda73e42412b4bcd122557f2d4ccde8a2a0c1
-
SHA256
2d19cbdd421ebf5024a12f4380d870d127a8b9348d7ababcced56c1bb8702956
-
SHA512
3a9192cc3cdf0d7d40b3daac1cb94d5fd47dec401936ea598bb5f36c03443a42ad7ea056ce4dd451ebaec1ba4e6d36c776db9b9d111a86eaa341f3ea9f13b6bd
-
SSDEEP
49152:yNegqYuOhCwDsH1q5eIU/soZwnmNBIUdH:y9u4V7X2sijNzdH
Malware Config
Extracted
hook
http://URL_CONNECTION
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c52092e0a75ec4adb444a02954d7ea2a
SHA1a2d147b38da3870e0e3b83e4b8dec75464ae4da8
SHA25615055bad365c4c664d08497da5ff623f422f2fcceeeec77d3a3d0b3c9896c3b7
SHA51227c92f90bd1e968ee223a2ca5430f87b9fc471277d1ffbecf45d4501048a85b9a455a9bd6326df4eceea1cbd1a49d9241de8f7955bf8e8f03968eb16d190893b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD51beed38d3bf55ab4ba0071d79be5753a
SHA1a18778cb023913459fbe5aecf9c77b0150004cda
SHA256319155de5aa1e0d6875d0da46497de8f6d6031eba8b9616e893fcc44e0e935df
SHA5125b57fa770f2ac81935368303c0f6df7cc865389fa06a465ada80a54f0b38dc5d22531fa053fbd8517f4cfe3c6dac9217cc86b6783781ba13d9563cf321bebda9
-
Filesize
112KB
MD5fdabbbd60f9b2d69a2e1c52be43e2c96
SHA10c0d57a629f560ba7f1f6ca0735436a481c94c61
SHA2560a7bfbbfd7452a8aba07d11667200cdd9deaad155517def384d7648ce4b21c9a
SHA5125d07b8e1654ea61a177fc5aa653bc0850bfff9718f18f5b4dcd72b5a9405e157a43a2fbb47ef1a2f9bc84ea107cb6c7cceab192e33cdd22bfa8f383eb50750e2
-
Filesize
185KB
MD5c315a38e134d42110d61e8fb73c41ac8
SHA124928b34a05afe4fec3733a98c46c98453ea7eb8
SHA2568276d5d5ff01b7bb6bec09478acdf1b4b00d567a6599c5c4d667f3a518ea685f
SHA512a56361075809e418d7755851d006f9a3ba1e5a55959bbc4a5993f05d29a1c6e9c6784d9b06063a92e6baae1012f89f179f011585b191f32b4588f65c65ed29f1