Analysis
-
max time kernel
83s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
24-06-2024 18:02
General
-
Target
79b2ad4c03fdac5cb4d458ca5d54c3ed8150ac13f3a605b260158da1895ba83c.apk
-
Size
2.9MB
-
MD5
1d22de6a9e022767a7342dd3d0cd11e5
-
SHA1
b06226600cccb3205004e1484141351e3d09b936
-
SHA256
79b2ad4c03fdac5cb4d458ca5d54c3ed8150ac13f3a605b260158da1895ba83c
-
SHA512
0141c0c3ecaf281b6e38fc3e0c2bbf6aa1adf2917c96e5ed3f91aa65539fd136fbb5c9ab990ccbd3b823bbcbb5c10ba1a3e814ef7487f64a167ac5152b872986
-
SSDEEP
49152:9yYyT89TeyXkk7vhi/QjILEnkygkD7hMQSNAQQZoyDiNwA9vJ8ig/CA5:9yYyT89C0DAmMELiQ1qyG9vpA5
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.boyutehiyepizu.pabeko1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD564d1422ecbeda64ea68507623d4f3369
SHA1bfffe4bfc6f0e84c8fb5dd727b13bbc4f51f2bd2
SHA256e06ad19f232ae5dc78e4ce76221c27141556aab2ed368ed28a4dff4e347cfc0f
SHA512891db64790b950a9650a140de407270542b69ba581c23bbf34f7012ef2913a14afee36b4b8b5d76742625028dbde53eb1c000b56b61cf02c7becef8f2c14408c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD534fbcf555254be253abba86593f991bb
SHA181d7f8d8802af891427c4a9d1e07631aa7dd3139
SHA2567d2858b65b2f2e0c772d88317b19b63ed70ea108d4f50a84933351d97470d081
SHA51251c1ca540080183e1beb8194e1e9a358b40ae1509dad9570ff37989a461e20f4a22dfcf30e50cd6e020de4904d831b023df6cc38742a6e53f0ee2d9e1e0dda42
-
Filesize
108KB
MD5154ddcc07eefa0a55a39eed0a3ef2bc9
SHA13c365db609f172e3cc6bf205e180339744bcfc1d
SHA256fc3a606ba674122f57ea68f4134403c3d09d5bcc99637502151164dfa44f4a9b
SHA5129d23b0e9b054f523a72559376642be6036e496a9c30f8473cc12025bf4a7e5c86908fd4b132f740838b4164b712de05f95828b6356965d22e905475cf3fb488c
-
Filesize
173KB
MD5b39ef954ae0c745686b58cbd51ffe8fe
SHA1e50ebc294c5f782eabf4ed00da08a6bd75a32e77
SHA2566a6b691d652d749b4bf1e74188752e7b785fba1ea0aa6452d76b3686d10e213f
SHA5127bab848d1103c06bdaed45a3c717553d733d4036f4a5af0154c3c7767f8f345e077f929ab21dd7fb207264fb6b1430653de318330d4762e904d4bd046fae6222