Analysis
-
max time kernel
119s -
max time network
186s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
20-06-2024 04:00
General
-
Target
ef9c1ee9c06e8f6f92e9388e445d268072a321a4bf77704054dfdfbc68bd8830.apk
-
Size
2.8MB
-
MD5
c0b49d35aba26433370836dacc9d3007
-
SHA1
fb46397f5d1a37055cc5323d89681dc0d1da5b85
-
SHA256
ef9c1ee9c06e8f6f92e9388e445d268072a321a4bf77704054dfdfbc68bd8830
-
SHA512
c14804d81e12cef1d154dee0c4d650508fd47ea67ebf09b063704834bfde6dd553d18ceb6223212e78cf621caa095aa979ace1dc75357ff3c211811c2bdfee50
-
SSDEEP
49152:R7gmZbnXsxJHCXVvEELV0AUgFw9EdFMVDvRXleFSl2Fu0cFUm4LpisVaQ/jazg/Z:FpbXsxNCXBEELrUgFw991VIYyuV6m4oo
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.gohaxacupumasa.kipo1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b9a4b95fd4600a37296383f255747324
SHA19b81b9bec15ebbbfdee86c2a44b5fb8bb1dc9d80
SHA256e377e1396d8626c7cc8d97b8c11d1fdbed6f305c76e8bd0aa33ac876175271c4
SHA512cc7452876185f370f5f1967f9035a059bea21f5eb20f4236ae6bb64693f95adfc70927ad6a293e7f3801bce69243f8433c59cc12972d2d9e4b524fa060467e18
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5e8c3c345239ea995c3adeb6661e6e3eb
SHA1fafdb11292269b14de069db40cfbf89f2e59f7d0
SHA2566dc2dfad71ba9344e86722ca2243e4e80e59ef10b8ad9eb8177d25dfdd07c34b
SHA51282aa771842b3cff82a2e9b7218b108e94fc10eca45ac36608543b62c6b1710ac0be83e6b9f7e665c23b15d3fbd22c70a7a6d6a7ee363220110ca2d8f3b4d82e4
-
Filesize
108KB
MD5ba15b90b28e91956bba54900a900b70d
SHA1397c55ec55d730e8a11b33095c05cfa9c75fb04f
SHA256e622cc36363ca4b2405120a99b4affead35d7ffdb2248d28205365dd1192dc31
SHA51265708fd8daa0b1f8fe5a3242060979e03ef386173f37440e28ac1963bcb8f6a74a275a676b6b0f2cd0b35f37a075ad8ec1560dcd137ed9bb813c44424838ff5a
-
Filesize
173KB
MD5344136f5c04e1837cd9c2a3d30f3029a
SHA1b421251dc9ebfa5695b75445e072174a20cfd061
SHA25697be14441ddb161343b8a3c30459a50086c5dcf8c355fb49019d8d18b31edc50
SHA512035b726ab6ed707365b3ee6868e164c9107a304ce77a7ec2a47880795497bae7fadc936991cfe390fb7052e42285c9cb4d7602f43467003f10faf10d1d6adef6