Analysis
-
max time kernel
178s -
max time network
186s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
-
submitted
19-06-2024 23:09
General
-
Target
b7ed5d3f89abf81a3fa6a73da14d6a3d15f6a617ebc62bd11e279024f33dab75.apk
-
Size
3.6MB
-
MD5
9027bad42d54a1d0c8b1beaeefb75b9b
-
SHA1
824899fa08928218d163827dc85aecdabe3dc7eb
-
SHA256
b7ed5d3f89abf81a3fa6a73da14d6a3d15f6a617ebc62bd11e279024f33dab75
-
SHA512
d349f7161628c36acd664b4b4122f79a7fa9db75dece9b94f6655e4da277671b3fd8fd4a4b951f23d52b2f8395e019748d00dc6180d9b77affa2993d72ed5489
-
SSDEEP
98304:W4JiP4u2K4eeb13oDqIE811hGrIpw6wrY8vbX:PsArhh3oqvVYKj
Malware Config
Extracted
hook
http://45.132.181.5:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.wocebucahodiki.sixuye1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5956f7c55d34836c95b756f8de94a955b
SHA147b2d3c7684083f6e47385e8d7c09cb8c136f3e2
SHA256584d04dbe7c753e0911fc6c5fcadef696067767d8e0be65a4f369ade01819d14
SHA512d4c101dc6cbc648db866f9ba1db0151463c51ee7e409f801da93aa1261809f0c6d25b4e06be2f124098dca736d8218bec9867d7b4259642653badb2bccded8c8
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5dca16a774f970e1538d8490bc1b8a1e1
SHA1a0955617bd4536976a5711f413d641625ac805bb
SHA25684e1e84f9f1e0590f83b4bc2e64df764220337a9626cc18aa9d86e4481692bb7
SHA512d3e288aeabc7b38b2674ba4dd7e76cacf2f2dd45016c2780b2ad2c3efcfd76919d293139a432a257d7964061831d9a1da6430a8bab387baedf05ec24e5eec5d8
-
Filesize
108KB
MD576f495c7fb8bce814a1cd898cda0098c
SHA171e2d4df6f0bc2072ed16c658711273cde6be149
SHA256740c34a3dc972797e90bea1f366a8da948f94ae72f4b39135cf9fc912333772c
SHA5124ca0a8b5071138e11f5b067fc404872eac6a3eee0ee5c10ba6356beb7266a345f9deeb3cd074ec7535fdd6c7ae942fbbcedf7aa6f20dac81992ed2e3efbc0c06
-
Filesize
173KB
MD5feaf97088016f01d7155ed7e1d61fbbf
SHA17fa4a277a7e8d095748a40ee7058066916954e45
SHA2563ac2680f4a0d17a9f0eaf984156bfda79896f443055f529878bdaf6b16532c14
SHA512c3c1b2aebb18eb0106606b873059d346136cfc057c9752ee82d04846677d0aed909065ec77292bffd95dbd20c474a66baad8626cb4399c06b9ae2d9f1d8cebf6