Analysis
-
max time kernel
179s -
max time network
128s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
25-06-2024 22:01
General
-
Target
childapp.apk
-
Size
2.8MB
-
MD5
114bf0d5c6c6eefa3549ba6258485dd9
-
SHA1
5ec88f000c78dbe85cf6e807e8ec28d144469bf8
-
SHA256
1aa526105b85cad2400df93b3e30c53c5be4982ccde416bd8dc23a3dc2f7e0f5
-
SHA512
5104c5b381c4e78273d3b9a6a427bd883588f24212352f75589418cdd8d5875f4482618ea300eda8900cbd16ab60c887451199fd5a24a3785facf9dc82057bad
-
SSDEEP
49152:rKb7U+Oou2DyWx4UgDdaHnevfxrtDAK8FbQC1R9/oHzfv24R3hag0gK/Xx4g/ku:Z+OmiU+SevbD+bb/oz105Xou
Malware Config
Extracted
hook
http://1
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
com.JiDpzrKa.WmqvXSVh1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD57a13e48099b060ef3a0fd5b3299505ed
SHA12555abe79b57dde05562dfba00ed476bd206f6b0
SHA2565ca58082ce2b53911a70087eb068fb7ce622d88b0d1db2f1fd80564c3a238cb6
SHA5129dddd5b2b4627ef64d51747f8b88e409b27b1dcb70e97a2ebfa9ae19cd3f4e1a05dae7d5937079ddae1a7c6fec4364f768f31804a1735ca2456d672b6d38b353
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c9ba32d54265238bf84cb2d7341433a7
SHA12b09cabcd3192bd23d02b3b68d2489813650f11a
SHA256715a561ea3f34d8122391a8d99988ea141601f4cbf879c7919bc221d153ebf32
SHA512fd3a2d6de635bc071572b1992e6ee1f49a2c21ec04bf30c3fabc36007c0b3cb70edd71bdd8ddcc8258c338696819243465faf3524e632256dddf65b6515bd7e0
-
Filesize
108KB
MD5853144e523f99627c4fe83aee2a045a8
SHA166caa27a8d2fede500549d8b0b6e087494dced82
SHA25623b48f56f9396064b20fcfd192510a6a83065da2f40a4171b7ed9d372767c837
SHA512fbb5fbf95a09cf2ad53112e24376e929a0c97c738ca8f2b2c5ae3717be2eb32307f80899696792a9f4496e767b5659d60f10ddabec840bbc9850c738d0d8be22
-
Filesize
173KB
MD5a583fd82b570af9ebf19b5fd2310fada
SHA185aa12f32440d91e9664aa9329a93a5e07287837
SHA256b51c7e0c6b198bc0a4d05456e61f5e4e5ba0f62e4a977ba1ecdabe87d2fcfef2
SHA5123fb2c28eb93c74ad220589c6f5f82506d419ad67b81aff90adfa9c6a010c747909230141802a9eeaf0c2e6b622c474cd9de0fdd6b84d6b30dd9c449c18e98cc7