Analysis
-
max time kernel
179s -
max time network
134s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
22-06-2024 23:13
General
-
Target
5dc21050729556821dfbab5e0347d120572875a87185485ec1d3a83bec5098e5.apk
-
Size
2.8MB
-
MD5
94179ea73a729302e17dd2ff9d997748
-
SHA1
672b11e3a69b18631fe19df84d8b63c9eb96c396
-
SHA256
5dc21050729556821dfbab5e0347d120572875a87185485ec1d3a83bec5098e5
-
SHA512
38b46accdc73b90e94118ed2b775ffc727c01243b3bcfb0c4584932bd72e50bc61ad173f6840eaa085a22526b96e8e2d24095d60f5124e73b024e25dcfe5185b
-
SSDEEP
49152:BwRHy0NESfRdVouTLXnkzjZu6DclQWGxw/bp+D5mJHsiHPDGLUgxedHyS3iXlMgi:61NB9ouXsjo6DNWIwoD5mlhH6gISSX5A
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.vosedotewemoka.noju1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50d068b7843fd91e9736f02f3db9c7631
SHA1aab7fae66569030ac78bdec0f6fbcc00b3da81d4
SHA256d76f77bc6338467c56efe84a048dc957d11417e987022548775a7b9e59f6c7c5
SHA51265dc58a2f15748fd72040c37e122b65d2df951b5b478cf1add9255fe7e7024cb3d19c0a4285ebd9f62b9849eb96bee1fdc7baad758cc36820b15e79335f8c217
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD564d1b6a7c9a16e1c7f1f9237124b6442
SHA1f1b9ea0ce9d9b15cc2587b068117723842de8da1
SHA2566d1609378c9fe070b412e1fb17212097414a8fae4fb74e863999aea167bb5e35
SHA512e0a6e6ea06e78c398f51b947ae126cafef545a84d705dceba7674e6e584b9c5ee372a9011424abeb581ac6fb0ca32f5d4a79e1f10b907b4ed4fbc38a340aadeb
-
Filesize
108KB
MD530ed8c9b28f62c580112c529b083ec05
SHA16012fb2ed1a081840b7b9575bb39df5290575803
SHA2565f196536462ef9bd68aa5a9e7cb25a254eac38f228a73138c8841f43ae6009bf
SHA5122a5d5290bf0162f977d2e9aac6536a2e89734cce64571c75cd061d1f65bd07d7f7628941700909fd1ae002bed4f17717016f4958cd071fe0f55ae8a54223eae2
-
Filesize
173KB
MD5717e448988ade2a00a65fc43d68245bd
SHA1263ca4ce32f3c2113674109cdb8429af3b3b357d
SHA256797d2a95f2d4031de54ed6bff09c775250569c2d47e750140e3b8ff96cf0d01d
SHA5121677c1a38232e3638897aa79bae696e5a77876ed48ae7fd40bb19fd19d3b55ad1d9966cf9964a9fe64b30e51d6f4391dad087e109d68fbea8afc83e5480e5650