Analysis
-
max time kernel
176s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
15-06-2024 22:03
General
-
Target
7c7fa2ed6d79e732b31646fb76b14d18460205d5088534f692e6c75f640da826.apk
-
Size
1.5MB
-
MD5
8382652688aa9f8f02f931bf1dd45ca9
-
SHA1
d920ab476cb99b3b669393763e9f869678f7e321
-
SHA256
7c7fa2ed6d79e732b31646fb76b14d18460205d5088534f692e6c75f640da826
-
SHA512
7cdb8585eb4b6c341c17db3d07f79959ffd5174faeda9874e7e46517345955b0a5db519b64af49b4a4397e07d9dca49702c7eced551e254ce7f63a6f0b8bfaf3
-
SSDEEP
24576:JaY36zGo1gqYivgZeTqYJe3edzjcwK71EDeBPTLcs+Gq1kK/mXgRKmGzgdl:JaqsgqYvZCkedn+71ESBPEsLqXjhdl
Malware Config
Extracted
hook
http://91.92.251.148
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD52aa14ed7fbc58062d85d9b522ae97688
SHA123fb72be003bdff1bc04f4d3bf143d428e5ba238
SHA256260f693f5eec1afa52ab618ecf728c4487bc48cb6b6944bd1176b11ba97845a7
SHA512b3ba4cc8936e92817d06c371c0e71bebb77d5445297ca17102f25056a5c363afa9a30a6b90cef0999474f03fa716325ac5b7e72c38e7f5f8ff85cf51c956090a
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD560c37753b0516ddf18a5734b267334be
SHA188d14e3f7c4f4d4ed46749407e88d4cf20557730
SHA2561d22d945562e66bc9892244c26a8d00e76ae0e509335688a9f510ad8f9cd8d9e
SHA5124a6ed0c22d5327700b0ee7c5a97c5e50be443b27b35c1839c440d50c701beacdb304083e1da8b8b9201b10ad8526197ed0681d74aa7a6229751b666d7317d738
-
Filesize
112KB
MD529e9840851ea2c1a7d48037afa8a2770
SHA12e6840f5220d9ba11e0538e85a5dfbe9139296d4
SHA25602418cdeabbaff3f26b9379f91da29b2f20ffdae8425b56e6881e9038349d1dd
SHA5128529fb8b38960f3d5213a0baf7a8e68a1edd7459fabf37e1d8893ab00aa24d025b08d302ab588a2407f4786397b71133509dd9ebeb9db6810c297f01239d0133
-
Filesize
185KB
MD5e93d56a9e3aaeb344de18ffd0b52ecaa
SHA164712e0adf239a6214f08b35106f72db5050e9b6
SHA256abda1ed1d385bf491f15efafd1da1db99b4f3a3dd40bc1ed6c5f3fb3a2ed6cea
SHA51227394f4b5de8158037d9865c51212dec795ab7ad249fb10115c6ab48763aaaad9d02b0854be5ae85d33d739917e86a54dc2bdf22e3bf78d9113c1d65addf6a07