Analysis
-
max time kernel
179s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
-
submitted
15-06-2024 22:07
General
-
Target
2d19cbdd421ebf5024a12f4380d870d127a8b9348d7ababcced56c1bb8702956.apk
-
Size
1.5MB
-
MD5
b8a90d312d6d9acaa2ebcec019968126
-
SHA1
558dda73e42412b4bcd122557f2d4ccde8a2a0c1
-
SHA256
2d19cbdd421ebf5024a12f4380d870d127a8b9348d7ababcced56c1bb8702956
-
SHA512
3a9192cc3cdf0d7d40b3daac1cb94d5fd47dec401936ea598bb5f36c03443a42ad7ea056ce4dd451ebaec1ba4e6d36c776db9b9d111a86eaa341f3ea9f13b6bd
-
SSDEEP
49152:yNegqYuOhCwDsH1q5eIU/soZwnmNBIUdH:y9u4V7X2sijNzdH
Malware Config
Extracted
hook
http://URL_CONNECTION
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5eb19d3d5bb67ee41329e88bc7fe69126
SHA164f63032d11cdead5c0f0563f06a6f9862e81359
SHA25660158f0956f17cd7a9d4818e053cd6fab8b43b73beb3e1581eff4eb361b6112c
SHA5121ef5843095787bd0c7425368842ce03cd1ed3b1e5f05d01690f160b0766f6b75ea480dfd25e428ccb0e6e009d9831c1927e50b12d0a49ac4c6362662bf2870fd
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5e4d283788ac8e33a88ae4ce309a3c5fd
SHA1ae5b7c2863e9d55737eefff4aacdd9c8253a9266
SHA2566fb1bac128b78778b06a052f265e29d5ada853082e71ee3809c8b08b6b1c69f0
SHA5128ce2d53045fbe5ab3a83e3cd74331eba5bc9e4c31d9ded5b4ac77389c10adf0d0a4d24c5cfcf9b492be73d0165e838409d3da237b22cb5e01471cae0706ef840
-
Filesize
112KB
MD57de83730a1018b454daf12d39931dd7d
SHA1db1e6bbbc4ed8daef96a513eff698745cb36a29a
SHA256a7f15d50d91025f9c3a71e630ee21dac5dee1add5f2b263a23a1e43adc2c36b5
SHA51264580c208f452974d9541940e455e13011a46e19c8d03e98aa3c80a1176373825d925250d32447b0f91a1ce1bbac57235b1b70d29086b666a6d420728eb71c7c
-
Filesize
177KB
MD51aba0ff545d7877d29c8496b5cd4135a
SHA13d3191e5dc0ae87d984d5ac6542e5caf2ce0e19b
SHA256f2c778dd3047055a5037e625846394e6583a69bb8a27a27c3d282a0c9c8f25a8
SHA51214465bb62cfbf86140293b1cc7468fdca0310de61821008e74087ff9d071f7930d4378b022aeefa075cc3ad626ab157c5caa11415750d5cc2041bb9902b491ea
-
Filesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b