Analysis
-
max time kernel
179s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
30-06-2024 22:12
General
-
Target
f556fde64e284290d98ed7eb41a3df59bb49678f064e6fc37ab8a939e54a33a7.apk
-
Size
1.1MB
-
MD5
935727fed9c86606fe63b05636b8f248
-
SHA1
620e899a3897cd082fb663b415b20d1c2b276916
-
SHA256
f556fde64e284290d98ed7eb41a3df59bb49678f064e6fc37ab8a939e54a33a7
-
SHA512
36cd509ff85979f29273e98882c31646e63a208058c73d259dc17bc1721a966e7616398d1f7ca1ecd1adaec744c45ac1829c6ad94543e3e413797d3815940590
-
SSDEEP
24576:+b5xoLthBy6XdJk59oPGIFV9qruoVpOf5ojyFFg//rPG:QqrK9YGIFV8rg5XFFg/zG
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5793a27f74f8eec1912420baacafc4612
SHA1b38425e6b15e27f16baf591c428e93cfb3f900b9
SHA2562e01467d1bdd2f9152f203a4f8ce93ff1f7b772f412eaf13da3b996a2a4a1e5c
SHA5124ccd12af7474a7a5fcf7dc2dcd8038ff0ba469f9434f521a392ffb8a1f5729cc7c0650e072574b89baa19b041fbce58721d246e01ba8c24cf9f5d6323f54c719
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5281a5d320d594cf6371d0a936a1766ae
SHA135a2542af0b00448d533b416cff3873160da9fb7
SHA2560273e8527a0b907734678476d6cf232205636b82424c6cbc3400d2a02afb0ea7
SHA512cdc91ea4293a4dece1f8d5b64820d4cfacaee00272e0c0d87cc94843b7094923ff47c91ee8402d0b6a0afe6010c6f4e9baa22aa41d3b7f07035000ffa01e0862
-
Filesize
108KB
MD508428d9292978241a6108651e6956b89
SHA1c31f9f93c7aac7a9174dc189e0bb706f6e5ffc45
SHA256e062d6bd7279f341a3179b6161e77004d7b025eed6f21571a291f15a5664d0ca
SHA5129f6a02863d2e605391a72195f47ef764f8168aaffa06432d4dea6b1b7fe0c895d0c4adead8fc12821862b78f0281362c73788769dc640a8795463238a545260b
-
Filesize
173KB
MD5b9fdccb6eed47678f38f8a6d33c0c8aa
SHA1b1f1d1be98aa086ba68cec2ccb46732b820782f9
SHA25664b11757e10c48ded3187c46712061d7c39ed89c13cdc43e831eea08dfb550e1
SHA5124bc0a5737c59ec4962bb059c1be61b11377d067fb0dfa5c47170feaad5c9b94748002d81ddcf9d737794edf45ab1ce42b616a7c8dea4b0fb9704cf442c9d447f