Analysis
-
max time kernel
176s -
max time network
188s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
-
submitted
19-06-2024 01:37
General
-
Target
aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531.apk
-
Size
2.8MB
-
MD5
0d0c23a96dc90d431a8ce01f0cee1575
-
SHA1
8605f8fb9d5de85b5bca0aa953ea2ea8df53cf84
-
SHA256
aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531
-
SHA512
7858bdf897659898c018aa2191f87cac4effa93e95daf3c4e449bbbafad1ab8248df0bb97e599e7f81a3dad0ddb3041ad712c8198a1b8635ea0b09f4849fc7da
-
SSDEEP
49152:mAT2grdSkQvKiMqFnr8CJMtvlB0l1EIFWEog1cJXCDG9XU3g/KZ:mAT2g5TQSSlrxmdva1EUag1cX8eXKZ
Malware Config
Extracted
hook
http://91.92.254.104:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5ff7bc3c5c608610a8e1687638b6f5493
SHA18083813ddf3de6acdea51606c4e3934dacb9fa4f
SHA2560c3d017be3412ba3bd9bc2594d12d91900d2584c802a0f8fdb1186227dff478a
SHA5123bb2f33ca5c6b53fc341ea766bedc228f24614b5697691edda98ca82ba8a3c6a3499058f8b0638d6f8eb08e2cc3c6959529b1caa4cb058fbc3b245bb56d6d0aa
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5bb54f0d821d0af606b757f109f68dcf7
SHA1da3b8afc912fa33ee0a6dc6ced0635ba2f943a04
SHA256aab74b8e50c361b645b47cd9c996232df1fdbc22ea89917c3d95eb071456cc7b
SHA512c326f289ad66b2823ad664b56e23dc4327eea78109cf87e44958c361a302117d1aa28fe27505e275104a6d509a8b41193bb9c960a7764d7d6ba229b0c200e3b0
-
Filesize
108KB
MD518191a078a8f3daba9d3b3f0e68d834f
SHA1a15ee503ce6f3c69dadb3abf1605e9816dca82a7
SHA256159820820e20f1050c298ef17d3cc789ee02e39a7e411de4d332213aa7a195ad
SHA512c7b52cd3e43035e5d8a194c3a6b921def3d01c0dc1ef1b73c7fe8a0cfd275450f836de8f7e0567f50899891f26c48679cbe69f48b8e6ba6836211a3d14b1567d
-
Filesize
173KB
MD508f64712067954bad11d8ea2bc8ae9de
SHA1c7e7b899fa384b7e707c52cf74c5ba6992247308
SHA256f56bc5dd02f7831a134bb0536b44a053dd6dd9349de1c87d514edb3093a4cb98
SHA512b22ec7ee83e4284504b2716627bbee20b2ad7439b6b1bb961d6764d79db3a5840578d2a5e23f252cd417d4cfe936897947a56fde41f2b6fbc6ce60c2988973b2