Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
189s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
03/08/2024, 22:03
General
-
Target
8f536b0a6c6413306c3f5d51dda702d52d2eeb4adb6d8314b389e71ea00390c8.apk
-
Size
4.7MB
-
MD5
9d488ae71f0a27acc0ba3a8dae2d07d5
-
SHA1
cdf4d3ed234e16e27f2669e899601cf7fd5fdb01
-
SHA256
8f536b0a6c6413306c3f5d51dda702d52d2eeb4adb6d8314b389e71ea00390c8
-
SHA512
99a8779075a40b353d8d8f9a3a7f8852b45e7b32775f313fb23763f96f52460501bf082777695a6b1ad38788d19d484146008b59dca472bf60934200685712af
-
SSDEEP
98304:iEZ0LPxmvw2WPeJ04hD1RZI6yue228mHIxilnq0HfrycVJQxnTJl:iEZIQwW7hD/ZLy628mHMitqKVaxn1l
Malware Config
Extracted
hook
http://85.209.153.135:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pintek.zore1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d779c5eebcc35717044edd28c9355335
SHA1ad4e782bcb41f52fcdb9c276112fad67fd82d603
SHA256cc2b8d0fd72e3b579855dd2962a05b9cbf128abd82ea0daa39742e98e049dd79
SHA512b41c87cf2ed66a5de7ea3aa1e5961141ccb3ade126971b948eaf0192724ff493d52634f8762c9f38d4c1a5a2231d56f6c59439b1c5afb11e1ebb5451b383c2c5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5ebe1ff099a04beeae0a723c06fe9d042
SHA116bcb27da606b134b9cc591576b06861e7c4b36d
SHA25635e884ab1757e78b79a25a1e660821df1ce1fdba2ecbe8c0e5f7e8d3421342db
SHA51206a2050fa1a6d81dda5b2da70e47aeef3f718a8b962cbb0462da224c3b98aadbb6e5ee80455d2de37202e851e840725e8234aa16f15caa90d0eaf8f152015744
-
Filesize
108KB
MD5dbefbd658cce3a27cf07f994aa44d7c7
SHA142680c241f911d939f048cd190b6d2081e3dc2d8
SHA256a64260f8391367561a78efdea24fa5fa0f054b49604845e01ba0820c12daa53d
SHA512c38b862004d87ffff5421ebe28191c0611015366eb11f6898d2a03bec6abaada2aff249666694436878afcb58ec3402cce85e1439e9355d59d8013c8c70c44f4
-
Filesize
173KB
MD5c148d0ed22b32674782a24afd80935c5
SHA1383286d680b683b06fba3d1c81f9ee2031f347be
SHA25684425fdaafe755d45c8dbea6ec34c772498d195cc8926756dc636673ab4b7108
SHA512036ff1c9f671193d3a541724d7600365bdddc25ace32b114976b4c31a6c86e0ffd22ffdebe33b5fea8c1c0b5e912a219a478b4746d99b6c1ef1f8cfa34ab4eab
-
Filesize
341B
MD5e949fd116ad03490bf1b7f8d470b2e3d
SHA12d671ce31abd7cb8a667de1a6bb718299a9465dd
SHA256ae3103e8744fcebf4b93f0f82ee6f11588a80629f68528b2b0e949fbc2129dcb
SHA512aa80a3faf4ca0e874310be28c1771b69f894ce0bbd80a9e3889ae5e4f55a2d0cda571bc63f43e28be72ebaeeca6105af42be2eeff2e47b1b0c098b76f622fd8d
-
Filesize
3.4MB
MD506dfc829bf9345876f04db7b69485799
SHA1afac2a96af43bfe4c6db99fcf0deff352a4f5a70
SHA25677909b82bcc2dab7e432d0547058313c5bcc5ea298de628a6ae05fb9d39d56f0
SHA512b57fa956d0afa8dab830592a42692df3577cd7d1479f9beaed790796951eeab2120619ecdc8801006e3a607dcdbfd8ef2592436fba19f838d1851c42948dc67f