Analysis
-
max time kernel
179s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-08-2024 06:40
General
-
Target
5015f9aef9dfa216040fa37d184b4071.apk
-
Size
8.7MB
-
MD5
5015f9aef9dfa216040fa37d184b4071
-
SHA1
8251b96c32c7533cfcaab8c661dcedc2e928e8ca
-
SHA256
d50d97ac082260f37f2694002b541abe7a51dad1d1664443c8efafa20389aff2
-
SHA512
fe7b9b11dc072b456ead23191ebcfe85fc4f89ec737ef2b48db0744efe5f5d1c11b46afb5200c6b32f0052d017903fe2833a48becb27e06cb53dc61d7860f75f
-
SSDEEP
98304:531f81q+Myp440EKT4hc0Hfry2gUrxnSh:l1oV0E3qEgyxnSh
Malware Config
Extracted
hook
http://149.50.108.156:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pintek.zore1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD59f2335d8318dc64753887faf69a9b782
SHA10ca05132f5c9b7ca01e947b733e8d5cbdc1d3973
SHA256e260f6f6757be32a2e67cb31479e073170c898d9b00ee6c0a182cab407f0ca0a
SHA5128e54626172bb384fa18aed75a9caa317df3d4e0a5e3b59ac74330e232835be4ffda4fa5a3e72a2ebcbdbfdc43d6e18215f404f97b871c8aafd9b16be20f1f15f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c96b667f3c984d443492fb6df8cb3f66
SHA1aca878543f2574f488427ad20c831e7127bd5c7f
SHA2565552ecccb5930cd1b75eca396f33e8b7158a299c4af2edadce08942902a46df6
SHA512709086feb7b67b1e309bb666338cdebb92a429171e4a685585772bd443e2c56fc3d0fb7412bea58ae5472612f707834c3c433d09de3223f53dd34cac2e50872f
-
Filesize
108KB
MD5bc20bad9539fc1fcadce7aa140e1cf03
SHA11e29e0c8aa233549d68026a78ba4ce64c04bf7ab
SHA2561d59216c43073b248044dc7e96a18bdcde7e2538c559c7cb8b8655d29f0df2fe
SHA51277fbcdc2c55c26434a33c06e5820ee614501837e94daf639c3c20c0143d099285ead68b33126866e8234d379d0c77b959c9e91c63759ae5f5cfb8689018c84b0
-
Filesize
173KB
MD5bfdd2afe5136fedc26855e286a6e8ef3
SHA1d6fd83e123c1ab6331b2f011e4fc8dfdd0d0e160
SHA2562d6a94be7f0401f73a6c587d8bf6e4af37da8027c7fd8499f84ea04e617c2fd4
SHA51232892ba844b3af404f3e299af69e0a36c693a4bb54a4fd731a57b1778f26e2d529c63d41450f067865a5f49981e4d43ad3385c471a9cccaeb5a79b7bc715362a
-
Filesize
341B
MD52edec008839fb978504045aa9786d250
SHA12aaf94c7a24a1cbb0ace57b4981d40ac1e0d4a12
SHA25611fce2ae50ed123de919227541276f50ac6522b554fd8915b6559ebb2f8c287c
SHA512644c3480e9103942e4aa2df715a5473a7585df291be6bb9c483c8a4dcbd799f0c2dc65daba5e038ec6326c6589e7f748e7b43bd9b1f21c2b6d899796c0aa139b
-
Filesize
3.4MB
MD506dfc829bf9345876f04db7b69485799
SHA1afac2a96af43bfe4c6db99fcf0deff352a4f5a70
SHA25677909b82bcc2dab7e432d0547058313c5bcc5ea298de628a6ae05fb9d39d56f0
SHA512b57fa956d0afa8dab830592a42692df3577cd7d1479f9beaed790796951eeab2120619ecdc8801006e3a607dcdbfd8ef2592436fba19f838d1851c42948dc67f