Extracted

• • Target

    9ddaa1bba5fd99393f212df4b1999c527448f07ebc9e26b291c3f1c02d5500e0.bin

  • Size

    2.8MB

  • MD5

    60c50ad04d5c749e4b8e4a9868c546ba

  • SHA1

    aed5c1ec0474b7bbdb48bf5069de8138e1d202e6

  • SHA256

    9ddaa1bba5fd99393f212df4b1999c527448f07ebc9e26b291c3f1c02d5500e0

  • SHA512

    bcbcf4d41f4d87ef75c607c5d6d8ccb1adda719a536387f0ea29deb4491f60ee9a5d1cfb1c7756df014b6c74b4ec1cf82627e1e09afa4de36fd38fddf794624a

  • SSDEEP

    49152:yCLI265cIBX3N7g63mngiXmLaL4HW9HF3vidqHzZDzQZ/HPAmOXqLBCi15E/ir6g:yCLI26xD7g2XiXmLaL4HW9HYcFEvPAIb

  Score

  10^/10

  hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Requests enabling of the accessibility settings.

  behavioral1behavioral2behavioral3