Analysis
-
max time kernel
179s -
max time network
186s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
05-08-2024 07:01
General
-
Target
9d488ae71f0a27acc0ba3a8dae2d07d5.apk
-
Size
4.7MB
-
MD5
9d488ae71f0a27acc0ba3a8dae2d07d5
-
SHA1
cdf4d3ed234e16e27f2669e899601cf7fd5fdb01
-
SHA256
8f536b0a6c6413306c3f5d51dda702d52d2eeb4adb6d8314b389e71ea00390c8
-
SHA512
99a8779075a40b353d8d8f9a3a7f8852b45e7b32775f313fb23763f96f52460501bf082777695a6b1ad38788d19d484146008b59dca472bf60934200685712af
-
SSDEEP
98304:iEZ0LPxmvw2WPeJ04hD1RZI6yue228mHIxilnq0HfrycVJQxnTJl:iEZIQwW7hD/ZLy628mHMitqKVaxn1l
Malware Config
Extracted
hook
http://85.209.153.135:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pintek.zore1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD506dfc829bf9345876f04db7b69485799
SHA1afac2a96af43bfe4c6db99fcf0deff352a4f5a70
SHA25677909b82bcc2dab7e432d0547058313c5bcc5ea298de628a6ae05fb9d39d56f0
SHA512b57fa956d0afa8dab830592a42692df3577cd7d1479f9beaed790796951eeab2120619ecdc8801006e3a607dcdbfd8ef2592436fba19f838d1851c42948dc67f
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c7083d4f4172193b1c3c5758f86aad63
SHA143604862aa3ed9de75688fc7cb59a9d369dc14cf
SHA256a18474dfd6641fe172e48b5f4cfa32522875a24749e2a5da6618282305bb9d9d
SHA512500230b71ab86fbe3ed53b8983258bcef49edefd926fd950557aa08c2bec18b75188d7266dbcdcaba1a83e30f51fead07cfa09ad331888e2123ab1598c7a5f68
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD560fe5e134b21f1582cba5d83261ec058
SHA1daaf5a6f1445e1cba349cde9700a0349b9825ff1
SHA2566b5d323a1823b2fe25454fe07f63621df99c5ecbc87f45c6b952f74ff0c44e18
SHA5129485a643c87d33451c8a84d15c2285a10f7ceb680d41bb94ef18c5e65df133096af471c0020f32a0ab1f497fd116e9781902007a1d58638186a17f9ade49e087
-
Filesize
108KB
MD529971be2ffff53a5b4fcb32efdcd948b
SHA1ff33925ad89f7043aa8696b926e6e11c5d283428
SHA256cc7c7382d63a994c2a8edaab86f44d8a29acff6bc2846d3a79e30bb1e682c862
SHA512a2e3dad4a334a6eb7de898cd77bbd191521a48f0fed9d94423680e38d5575b98f0e6e0cd75ae6ace3b0099afffaa55524730f84448232578e6d0e43c84c73a09
-
Filesize
173KB
MD5600230083f997c620a5eefd943eb6eb0
SHA149953d51af70b7d6385d2fd55a7cdb9788f9f475
SHA256bc5a36cd0a52198c586065c4a5630f743cbc44789fb698b85174adcf90c22081
SHA5128111949ace9c95ff886caa13914d5622fa79640e03a578a734c5f474d5e6510b2951e9d2d0c6795f521fdd7f4aef017d3da7ab6b7cffac92b57bafac2ed32061