Analysis
-
max time kernel
178s -
max time network
180s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-07-2024 22:01
General
-
Target
4149e4a3434c44a87f55b5643d5bbbd55e093dc592a600be679aae9dd3706897.apk
-
Size
3.5MB
-
MD5
d097ba2ec6c71d7f0118cb3bb11f89bd
-
SHA1
d3310070f7f5065f218851b5445c7034a382600b
-
SHA256
4149e4a3434c44a87f55b5643d5bbbd55e093dc592a600be679aae9dd3706897
-
SHA512
d0a54a35b36b736aa55ddd23d8a53b1a8bfab08b290c8accd527f7c4993439496d72d785b68767c15570ebb5e137485320098d548db14cc54bfd38ad298c39ca
-
SSDEEP
49152:r+LlX/wLODvIv6CxceAWbN1k55gQVxF5HaH8Ib/iVhT6+cfsiJTDMQGNgEJWzJSu:r+LlvQSqrN1yXF56cnl6+/ihDYPbS6c
Malware Config
Extracted
hook
http://192.168.10.24:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.fogipexosisa.wesoku1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD556bd0daeb8370693f2f8534c67ae4eac
SHA1e481b108eedfe577ef264c0983b6ebb57df62bde
SHA256f33fe51271541ea5cea3b8783a49a28310fe2ca7ac3436a13b00d5774ca4a05d
SHA5127295e9d61d04d892d287ef0a4fe9f230abf3426f4ffc1852d7642503a759752025d88aacf5c0b5ffae56ebdf185357268617c8468903ae13e76b03e342d7cc84
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5078486ec3463e456b91f88eac6b20514
SHA1633c6dbb7764146674bddf34ec2b55907fb10f5e
SHA256d168ffd490655b865066cb15f253408e9521f4cd5c4b150241ccf3fbedfda56f
SHA5120297a12765688a7ae2a9e6b788a25cdbce32586039cae2147a8777a3cb7797847088f7b51d1f2bd3b9e8406db1d36e78ba9e7eb054161b8fa563537bb457a745
-
Filesize
108KB
MD5859642b272c833119ec695d84d4e6739
SHA1f53c456341c8ac2b5bf28da8e01b55a346edef93
SHA256fb9e391e14241acc708f4bafe47b478a567fdf4b6485b0a635fb7c46ce382225
SHA5121e98030950b996c30bf4cc94898196f9199db63af57f88ac0162bc79914b262f6ffcb6b26efd96aced69d4cac7aaf1e64bffa13745f7a7c8b652aa02c601fa26
-
Filesize
173KB
MD5d236781c36a6789995ba3d5a1b1f8729
SHA131e192836ae178a39356935a86f63ae1c129d393
SHA2562d98ab1ad83241c1b6df797ebf8135efd386039d3f19e52e93f8aec632f35f4d
SHA5128ddeb3582c098a38fa65f9b498b6af249c959377be37d741bae9b156f20573fb89fefc06e07854f6c637d18a85123e0c7f1f8b6cb4861dde56ad58c66dcac63f