Analysis
-
max time kernel
178s -
max time network
186s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
-
submitted
18-06-2024 19:43
General
-
Target
0d0c23a96dc90d431a8ce01f0cee1575.apk
-
Size
2.8MB
-
MD5
0d0c23a96dc90d431a8ce01f0cee1575
-
SHA1
8605f8fb9d5de85b5bca0aa953ea2ea8df53cf84
-
SHA256
aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531
-
SHA512
7858bdf897659898c018aa2191f87cac4effa93e95daf3c4e449bbbafad1ab8248df0bb97e599e7f81a3dad0ddb3041ad712c8198a1b8635ea0b09f4849fc7da
-
SSDEEP
49152:mAT2grdSkQvKiMqFnr8CJMtvlB0l1EIFWEog1cJXCDG9XU3g/KZ:mAT2g5TQSSlrxmdva1EUag1cX8eXKZ
Malware Config
Extracted
hook
http://91.92.254.104:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5198c9ada1f84bb6fe1454e10166e4ce0
SHA15ab7f05ed8632d3d593eecf42620d50549af241b
SHA2560858ed585c883a29963fe62fdc3bff6536debe30851b49ee4507c8ac8680eb6f
SHA5121c02ac624b9b52e6cf574f0453af3e55edf93eea4fecc4196a1b1125b9c31ec13bcc30a09ccbfb13da6be912469eb465243121f90684466f9e9e6f90e83b7061
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD52e3edf90722e44d90d230a49e0de6212
SHA11e679bcc2cc4bc7829c9f3d7339bd1bc0b8ea5b6
SHA256ef818a79d14613238cbc223a7a2024c55f3c68f7c30cc944849235842c15167d
SHA5121c8a5968bc43be5ac370b42906b320ad67820945b4d3a36a367abe48f599620abf2078cec22ca0e3fdca9947c536c18cc0d5f388c2dfe620758f5c59e69a68d3
-
Filesize
108KB
MD5b269d6c4fa7c80683302227e82c4558d
SHA1b4b9b35541363db85cc4f260e6bb216d9ace73a6
SHA2567899f2a1ce27e687ffa1c6ecb807915b3d559d52543b2b5bf014f22b9743f5f9
SHA512f2ca7972778a45fec6f0d890787bdfe62e526fbed9fffd61a4fd6d8a917b2f6968668013d0ae4bea92124a47ae3b46b43a29200e614bda0f3c3c5e09e60e675c
-
Filesize
173KB
MD5b96d7cef318bff6be61bd278cc06ffd6
SHA1fe55f5aaa4eb9f4e604346d00c5ff3913bef9b37
SHA25634bbfe8ccf2961120d3dc20c7faabdd588e67c458dc3e09d42c3f04bad3da55f
SHA512e332322a5e71938e67884b9a45161cad09698ec1fc192a949d83bb475c173e2eb453a4677e0605654dbf4fb0b3171d1d21b403a15366f3359697b61c1a17683c