Overview

overview

10

Static

static

10

4a6604ac4d...c2.apk

android-9-x86

10

4a6604ac4d...c2.apk

android-10-x64

8

4a6604ac4d...c2.apk

android-11-x64

10

Analysis

  • max time kernel
    27s
  • max time network
    184s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    29-06-2024 22:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a6604ac4df2319fca1238caad6e6a735399f8b26ad03d1484b053fece2780c2.apk

  • Size

    2.8MB

  • MD5

    8c184873aab580dbe1c893f521a33d2d

  • SHA1

    6ef79892fca7ae2f7d05020d61e5522a61458909

  • SHA256

    4a6604ac4df2319fca1238caad6e6a735399f8b26ad03d1484b053fece2780c2

  • SHA512

    aba946d9c387fe8af9679755abbef832e3bac45752754ec8354fe01cb62c31b8c342ad80e00792f3549f27550224ee0390e63dcb0001970f9455ccd5f3365299

  • SSDEEP

    49152:P3bJCKhFWhrcdC50fhovaaSu4nIUkvKOnJtiWEEvdtHkHXO+2der0hECnoddXAva:PlCaWGC5oPaSu47kKOJtjE53L2dWgETv

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.wufeyusedisusi.racohuxu
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4481

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    7d9aa030182396b1623d030bbf1d03ee

    SHA1

    822d6af9bcaea691cf5935cfdad35ef5e54c4d88

    SHA256

    df6baaac6ad59ffb764abfff3a2bc59bd9109de3cd7f6f6f8a1e58c08efbdf18

    SHA512

    260892a1f65b03d4eedaad1bbf8df6aed221aac61da259ef6e4fcfa624ace54c7be6fc685db7523cfb7b21fad63fbd45c712c78e9dffaf6863a7a0bc9520cc7f

    Download Submit

  • /data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    fd3f3c47d5069c80b630f4c288265453

    SHA1

    4739b0796dca527d480bc1edb39d5de8ccad4acc

    SHA256

    97ef9af353d319a5c5b98be5cce567513a140461df1aa04b4def349501f0de3c

    SHA512

    18757a97a54b1912dfc21ba19e3439e57ba4b7d47fbe30b9f00fa53d18ecd144140544017e8dedf7bdcc302206624457e365d80f230fd53d1b2a168d92da3027

    Download Submit

  • /data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    afafe24d5ed500944d4d130a68851c4f

    SHA1

    c1e96f08cb5db6ebd4348b414307984d8fbad33f

    SHA256

    ff326aaa6ff5c6f4580760de70946d90c5be5d58b5faad0c9fc5d4829c2ab506

    SHA512

    11f591111d55dc55ff53b7632caed0096e5fcff83092fcbbde9dc9861bd81b21434c985d10621654060ca5f56490279818c85b078a7f5bdfe470785c5eccbbb7

    Download Submit

  • /data/user/0/com.wufeyusedisusi.racohuxu/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    3cc35ee7e80e61c67dc057e544ca1304

    SHA1

    e104ba0096543b4f877a42cc577344224bf6b4c3

    SHA256

    e86716dfa9579a1a6d2ca13e5fa9dda14b70fded066ca6ff6986f2eb3e414115

    SHA512

    b91a64620c346f85491a148b1bcba6eb47ba01fa145795563b8e6e4d99c681ce3407128be8efbc89feb84db68617915bfa9abf085b4e48de594b637c7f7a7d72

    Download Submit