Analysis
-
max time kernel
178s -
max time network
192s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-08-2024 22:02
General
-
Target
5ca8952a6034c37c8ff983f55eb736cae50ca7194cf285cd4af93021cb9a7894.apk
-
Size
4.2MB
-
MD5
ae00a6bbb9a0f33e1fa641a6a64527a8
-
SHA1
4cf897ff1f51a7e2efa4725dde128329ed548a74
-
SHA256
5ca8952a6034c37c8ff983f55eb736cae50ca7194cf285cd4af93021cb9a7894
-
SHA512
f107f25a55ff0a25a0b40d3a5a2ea321d0ff865a7853721a40383335408ae7ef9fd3d9b2b4256276a8a1ab7d7973ec6785b4eaca62cb1016b0e4b7fd011c2d69
-
SSDEEP
98304:FlgysHdGqrVeqFAUja79RCoQl+DT26mkOLHn+HGA6t5Q:psHvfhseow+DJmkSHAG8
Malware Config
Extracted
hook
http://qoli9va.xyz ; http://s0kvaye.xyz ; http://mal5ino3.xyz ; http://be3be11.xyz ; http://jeck6b.pro ; http://yayammib22.xyz
http://qoli9va.xyz
http://s0kvaye.xyz
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nrwowmnjx.wbmmqaubo1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5eef38173586df8fc03078023aa40f4ae
SHA149fef51b36d290cca519b7a8520887b9b40e6162
SHA25623958906ec6f4329afc26a665ce836f5a9928ec2cf3b19f4e5c4ac3277549c1b
SHA5129edbd6673d55b17908e55ba86f8fbc3abcf596f0ddbb4ca58c694ab1ada90da6448e0445a3393c4894a64bb1339e30feffad54671ce74818eed263fedd48b90b
-
Filesize
1.0MB
MD5a5d5991d4d733b6d991120064dec065d
SHA15d900cde798f6badfb64563dd9354203d5c402f1
SHA2562da6239cb8abdbd200098f52fe47720bf19a6bab21a7b56ecf8565a40657542a
SHA5129a0c874764aa5ff91dfb69adbbfef96dd209c51b31d120222609823dbabc46b277a77039bd0ee1b5335772c5ccdd3f81fe457d22a657d271f67ae15b4a2f25ee
-
Filesize
1.0MB
MD58719479c98a818a9774f0b97b7516462
SHA1f8eec207d18397f368bbd772bd1bddf9f80bf119
SHA2569b9a26e2860f8a29702578d33052a08c0ebeea56fbae228f997aed21282d9933
SHA512581761058c19c38b125e5c6251afb35cd618bc348d1b88c56aea1b75f36da054f640f202247935830b6bbf4fb97adff4f3e65b0a8e46ad7f01192228a6a18329
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5b5048e4cf41f4dbbc672b65e3b676f60
SHA13978a29d095ec700f70822d3f00160adc1f0e476
SHA256ecee28c05f3afa7625abe608c39b50cdf6d7a069443f713b915f010406b4a493
SHA512bad0abb519fcc2bf0a322863405a4860227889339054f998bb16e05f25650b8f0257273ed871a43f10997da0ce3ad158e6eb69082963c08c3937870304e23cb6
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5325e810d1fb6732bf5fa97a67c277255
SHA1e93d89f3e851c9de51b32feda2d274d266b2b4f0
SHA256128145b5f46391a6810879ce3b40d627d29aabb998d7dbb57402f783f4f59ba2
SHA512a38a61877bf5cede9ee265ad632990b11cddb6798f909b57e43b7846f1f273bea6e85ac072e0c40d1cf3fc9d0625c3e3a50c48c1af1cbaa8e9c686861a3bacd4
-
Filesize
108KB
MD5925da20b4d1439d7b386ac3bbfe5779f
SHA1ce12895f6ddf9c582e23831c21cd9a5cab1cacdc
SHA256a46806503d3780e91ad75c2285de978adffba17f1f6f30c541abad2df8a3705f
SHA51268335ec2830ed1b052792931a09718da7bad145e6b600652e71338bc8dae19cfde35a751128de63aa6c342b2710b4008d599716d67ebf4f1fba42082dd00f1a1
-
Filesize
173KB
MD52dcf920c13eaf8b23f8ad3dfffcb8066
SHA140176f726d854bd5dc02226a8369d4fcaffb1e9c
SHA2567be17ab5de8da5799fc0798a08dfbb208a2b74144eb2ec8f7d80e76ba4f1079a
SHA512357df8e86e3bc2c85b8dab9ee476dc970386caaf86fc70b5b779da57b2c4b0c3dbb56ff297b05441ac1a9964915be8d6fa4818fc7b94317d16a223b675f64114