Analysis
-
max time kernel
179s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
05-08-2024 06:40
General
-
Target
5015f9aef9dfa216040fa37d184b4071.apk
-
Size
8.7MB
-
MD5
5015f9aef9dfa216040fa37d184b4071
-
SHA1
8251b96c32c7533cfcaab8c661dcedc2e928e8ca
-
SHA256
d50d97ac082260f37f2694002b541abe7a51dad1d1664443c8efafa20389aff2
-
SHA512
fe7b9b11dc072b456ead23191ebcfe85fc4f89ec737ef2b48db0744efe5f5d1c11b46afb5200c6b32f0052d017903fe2833a48becb27e06cb53dc61d7860f75f
-
SSDEEP
98304:531f81q+Myp440EKT4hc0Hfry2gUrxnSh:l1oV0E3qEgyxnSh
Malware Config
Extracted
hook
http://149.50.108.156:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pintek.zore1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD506dfc829bf9345876f04db7b69485799
SHA1afac2a96af43bfe4c6db99fcf0deff352a4f5a70
SHA25677909b82bcc2dab7e432d0547058313c5bcc5ea298de628a6ae05fb9d39d56f0
SHA512b57fa956d0afa8dab830592a42692df3577cd7d1479f9beaed790796951eeab2120619ecdc8801006e3a607dcdbfd8ef2592436fba19f838d1851c42948dc67f
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5948ca53b07794e8ff03788ac0d875905
SHA1045c1767d12b07c7697fb94ff6ef51ecc23cc505
SHA256d9b68d9e795360e85c7de4a04d702360dbf262591522b1531b1a2862ab496010
SHA51253a648d0038aff5bfe332656b31c094ae6f07b249d2c940bd883cc245ef86af798bd0279cdb032c0b4e49934764419d1652a86e22581f2bcb8d982f3f1a3559f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD511eb325d73f80603fc34528f69772f07
SHA1e52d245dd9cabfaf56af8b04e401471947135ab8
SHA256c0b698c9cb0d6bffced4fc3515125391d5f6e576da6327620c17bbaa37774a02
SHA51241614c154c7b7087bbb793972dece1d5b5ae9b806d2c0e249ba726308c78bec5aea03e37c9005108b618ce072a01c9108085a03e281814c504189f8f2962867a
-
Filesize
108KB
MD5ffbf8076f0128ea465402d0be4c94844
SHA1c815a0d4ee7cce21d1effb6028e6c825ded30156
SHA256b8644dde88400ecacbb7a7b6e9f27057a7b6ed88ae9cbe11db81ca97509ac6e4
SHA512589e1586a2f4e20d9828f524f40a403cd4fb48ec5b2197618613c21430892760997a9bb90a929da9c9a5953bc878e17e2b79e53b3e13089a660cab3899880598
-
Filesize
173KB
MD59917db1ff60e178c5e540691378ab0c3
SHA18e7a10ae7d5eb4923005e24c0bed2a43d6159286
SHA256bfbd7b6575f747666dbe9c804626873d9cfb8f8612370b547919f56bfdcfd297
SHA512f31123f5560595f844a4d95d9eddbe155267731ebad0a796d3249ec3da7a2ac38a98fc293bf07483655b0384569491ebcfe8b2f30065c7d427e7f9ab06d3361e