Analysis
-
max time kernel
47s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
30-06-2024 22:12
General
-
Target
f556fde64e284290d98ed7eb41a3df59bb49678f064e6fc37ab8a939e54a33a7.apk
-
Size
1.1MB
-
MD5
935727fed9c86606fe63b05636b8f248
-
SHA1
620e899a3897cd082fb663b415b20d1c2b276916
-
SHA256
f556fde64e284290d98ed7eb41a3df59bb49678f064e6fc37ab8a939e54a33a7
-
SHA512
36cd509ff85979f29273e98882c31646e63a208058c73d259dc17bc1721a966e7616398d1f7ca1ecd1adaec744c45ac1829c6ad94543e3e413797d3815940590
-
SSDEEP
24576:+b5xoLthBy6XdJk59oPGIFV9qruoVpOf5ojyFFg//rPG:QqrK9YGIFV8rg5XFFg/zG
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD55b64c018781a42fd336b327b7870c80b
SHA17ca3ee3f6dccc619b870fda84500eb2623b922f4
SHA256465a2d18f322473941cdd20e4bc555857017f1de1907e6dc850235975cbf00aa
SHA512ebc614d75c677efed4eb8674413687397a5cd5bb51ed299341e89d0bddf713e8fbdd11ac1cd1c9a9c906e268685c36b3e6bc5c741251e1b0b3c465ffa49d7c31
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5e4358ee485e8b8bead388578727912e7
SHA12a503f14aefb706079c0e627413bba3e20ef248a
SHA2563c1ca6cae004a011cb7b468d3cef62df45b2a5b042c1cf48ee8e6f7a9648d3f7
SHA51207113f8fe28b1319dec493269527014a459b1527b671fca2c18eaae8dae9bb90a63fbf49c02dd4549016bc118a1cc7e2bd8809af5a78b158cc425d880a112945
-
Filesize
108KB
MD56cd654d71068f8fe238d7a35d7d6252c
SHA1c01b53ca7f5fc95599b008129b762937c8596ef4
SHA256dae7bde008a3e1101ef512fe88fa52b717f9fe90da3bb83b1776d0e6981bdda2
SHA5124a76710c58acab20ad9e18a5d8824f7dcd2c1405afdff82b27ef5e7f80936be602cdbae421e1f65ac24e17928bf3abe68e92a12635e1cf6ed461e76335b55188
-
Filesize
173KB
MD5959f71aa892325907e2fca529885ed0d
SHA115e77702b03dc95c31437c8db1c3165c088d5d16
SHA256d38dfc4401e8c4db314c142d678f00bcf9193d260173a66ace72d1dd7e9775f1
SHA512d7e349f44eb6e1d9c99d5ecbb121d567c1ef9cbc64ab7e5891f7851450afd618ce932591344b661822381ef1dabf5d9bda7ec41a4d15fb89a686e33ff88c457f