Analysis
-
max time kernel
179s -
max time network
186s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
12/07/2024, 22:02
General
-
Target
5d3334f9fc8513bfb55b095e6463960285abd45876e76f562fcff94fbf6b6861.apk
-
Size
2.8MB
-
MD5
e038f8289f8ca7e5e8093c306be9ac66
-
SHA1
1a71ebe79518bf5f00a9046c9b42d151882ffc26
-
SHA256
5d3334f9fc8513bfb55b095e6463960285abd45876e76f562fcff94fbf6b6861
-
SHA512
5aa15f7751920766cd4088bd6eabe2c672243c13a4dc780c2d6954caf726aa0745efed74d28e46b086e4aa29c732d841d316dcc58cdc236719781fcface0f80d
-
SSDEEP
49152:zMW4v6i2FNiGKjmOqFFBVjShvoVs6mn5LYH7qxj9cH7BcrSkCuFnKhpNOJCtO:QW4iNNpvHuQ+Z5LCqxj9cbOrSvuF5JCY
Malware Config
Extracted
hook
http://45.77.146.136:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD52c2467d334c312552dbff7f500ffb80b
SHA1f07f2c7b9250600201deadbf4888693c6f66bdda
SHA25690bbad99ceb9ef41d187170eed8e2c8a2e317e98dac7075cd14ee04eac8041c5
SHA512bcfd9f4f99fc5810ceba091d42078f37962067790c185eba3ada04f13551f7f7d54b9bb502faab884690a45aa4a9b2efa34b57d7a9e930bde06109d60e43f40d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5540dfbda582181e8c8329a216809251f
SHA1a88c5c05075ad348a03c183bf99ef8b1d12a0831
SHA2560e821c84ac39b7783ca961fac2c5526776c07911cb6c6dd3aba8ec168814a895
SHA5122bd805193e09f52649b9d493fd577aafa5403337a6c99c4138c91a40d6bcdd6a73eddc5403a66e0aabd9ff3a83cc9801f193fffe6e453deebc97ec4975b0cdd4
-
Filesize
108KB
MD53b432ef6bdab0449d6a11c26ef45cada
SHA1cd5ed5edbd446aaab65936b41b8e07aa6e96f1df
SHA256cc39a4916641955574cbd951b8effcffadd0c880955bd07f90d45ded46e47bee
SHA5128c0d5fdca371cef1e957d00aa29a1bd216500b564272509ee68cf8034c080fd1592f4b10136a9568e42484b27629d6ec62e7a3d678256aab24b99dfe5420b22d
-
Filesize
173KB
MD51b4e676016ad75bb07560297a57587a2
SHA1154ff137183082c0dc62a58f95a5582bb2a13a5d
SHA256dc672c03ffeb5e2352853e65c87474af8e2ea558cec3562b99480792c87938c5
SHA512fef43b86dc23387d9207e693450de0516dc08a1519fc982dde56a901b5f89035fe374a76659ef7daa59d160d0f9ce83314b08e156668d8ac51a2fd746cfefb5d