Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
26/07/2024, 21:18 UTC
240726-z5rkgsydma 1013/03/2024, 20:54 UTC
240313-zpt1nsaf53 1013/03/2024, 20:50 UTC
240313-zmj3page2v 10Analysis
-
max time kernel
179s -
max time network
137s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
26/07/2024, 21:18 UTC
General
-
Target
3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453.apk
-
Size
2.8MB
-
MD5
db6463dca0973bb704ac9fce68a1dd23
-
SHA1
c35ffe6ab3797981da3b8fd830d4d0b3f3b24e2e
-
SHA256
3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453
-
SHA512
bdae2fe17fb616a22c8559083e30d23ae5030923bb3dd95f7bab6e7ba38d19a22fa3140048f6cd222b2bbdb5087c7b9524fd695877734b3f64c5c809144f4fd8
-
SSDEEP
49152:9OcwHfICXpT/JVb0Tnb3fj29kgzpWUYCHBSZyL1xB07DsiHDwJAC6lg/Go:cT/ICXlvb0/PjakgPYCHBSZC1XCYiHC1
Malware Config
Extracted
hook
%INSERT_URL_HERE%
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
-
DNSssl.google-analytics.comRemote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A142.250.200.40 -
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.178.14
-
142.250.200.40:443ssl.google-analytics.comtls -
142.250.187.238:443tls, https
-
142.250.178.14:443android.apis.google.comtls
-
142.250.179.228:443tls, https
-
142.250.179.228:443www.google.comtls
-
224.0.0.251:5353 -
1.1.1.1:53ssl.google-analytics.comdns
DNS Request
ssl.google-analytics.com
DNS Response
142.250.200.40
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.178.14
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD58ba3af0e20f84982757a09af7cb9e870
SHA1f10eaecd7c96441f1a51535dadd4e549a2499698
SHA2564b02360b489f91504f264c9fbdbcafb3aefd7d0692836838aa07592219f02874
SHA512d3a5cfb5e5ff2108f4817baf491b17ccfbf9312c40f705e4fe8d9950dd09c747f0993f0d3637cc2997eb11e2c18d868d965b690fa5750077cb040df1c736dde3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD58f44064b1aec9828bb7c30efb0716a95
SHA1058113c9034b7f4d7b5190325d56838b18172483
SHA256d17300ad2dfa2628b761c1ce632d71d4a2484f1f69a079d9b8e628d6f8d140a0
SHA512745f0d810a735221b2352611ba003d89e652e32f1b34550f4a3f43cdc46bf643c0182dd2f7cbf5ec91199175afe4a1031bf9e0273ee1640a8cb18d7871888872
-
Filesize
108KB
MD57fa5a43356d628dc0941ff1e17739114
SHA17e6381fcda2c8a8d1abf259d1005f2d6ee026c5f
SHA256f8c2d2227adf38498b259780607debdb63927544c1d07fe96789dbfb8028b43a
SHA512010197a0585e8ba268b90a23bbb9642644bfff5fa659681dfe3359c9f35e7c7bc8c8f1efbcc84773359ac0e5acb214620038921395f0927fe2af9004ab7467ba
-
Filesize
173KB
MD5df744a851f11eaec04b08bad1440d7f3
SHA1eea0e79e63fb0e1dfecbf10148c5a882704e00ad
SHA256ab5ddc1e9606ef92c6f78aeb3d27a9f7c9ec9b884fd7f62ed3bdead1f9859b36
SHA512b369f8ae8b1f1fdf1935934d85442d97c54a9d9ce0d0be2f50ea75e67027c3405c33b2ba87123a784192d06dc78cedbdc30c20090a3eb5419330c6047e841cca