Analysis
-
max time kernel
179s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
-
submitted
15-06-2024 22:11
General
-
Target
22353a2f87384ef07cb727cf4ec7f07ec740226a08975134505a32ebaed5fad2.apk
-
Size
1.5MB
-
MD5
9b5a6133c011c64f0719549e63829c57
-
SHA1
b7dc9aae6894e361c435c5adbcc929c787e80fd3
-
SHA256
22353a2f87384ef07cb727cf4ec7f07ec740226a08975134505a32ebaed5fad2
-
SHA512
1cdee67f7c7b719ad088d802638d4103e89b5fb4c670084d2fc9f2de3dc8b254be27f18ecc34385f285ab5fd16436bd150aa1ac963e39440f2c85523c6e71c28
-
SSDEEP
49152:njugqYM+m4+uLUPzfSrmHWz7/ty8+8bYd+:nvMS6SrJz7VX+5d+
Malware Config
Extracted
hook
http://URL_CONNECTION
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5f34053c42bccbaa564a06b14734ee09c
SHA1c6ce148714e90f178fc5c025092c9da82d3596ea
SHA25624a39a92ff8fa7ab7ba94647fbb6b9ff2b46f269375cc8c9b0e37e15ecd1fc01
SHA5123be6600b3c412abb07a88ca32c4a641781bc4934dc2f8a8b66f2f92396cf88c20fb5b56856cc82bdc2c0b5148f08e4951c018f4701eee11eceeaac217047b2b1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD517fda786af59a22dc047540788a94d2b
SHA10be7ac97efdad94b24413408cc7757311872e9fe
SHA256e70a23e5d1db080e6ecaf214fcc9fa55c6eba14b044a6f01e08dd998c8c5b0f1
SHA5123cb3877630395a4c204db1f7ecf26f0634d138f6e19be037c4d97cd844485eb25f8c18e027341d414b3e3d01035c788835c0a2240e0f4755eaa8ee829e39d0e5
-
Filesize
112KB
MD5a23d9f36a011153ce43650cf1d94ff1b
SHA17578063bf69cf2d596ad91de593949866f0745fa
SHA256187457e3cdb6c822365fd3a8b40765799ffd867b2dde9454d50856d07f5dd862
SHA512a5a8c65982099e973dba70cbc4b35f179cabddb731f43775c4740be3875340326f7fad34340e939144a3672b8b2117bf21a32581a5088e9bb8ec4a3ecfa4ee51
-
Filesize
177KB
MD5977794b6311078ec65361c8cd068aa0b
SHA16d0247de8615a1ff7f6aff0ba1e609e98edc4f1f
SHA2569c7b1ddc365e52cd1d23f910796e21ab4f76bf3db8b6814741fe6584bfcddbbe
SHA5123ad71de70b2c9b97ebef435f4541fc6c698f96c1db5aedcdfc4e4a4b48796a0152c726bed03f0d9ba13f915924894853aceef4a58a3d5c866afed979d2baa15b
-
Filesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b