Analysis
-
max time kernel
176s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-08-2024 07:01
General
-
Target
9d488ae71f0a27acc0ba3a8dae2d07d5.apk
-
Size
4.7MB
-
MD5
9d488ae71f0a27acc0ba3a8dae2d07d5
-
SHA1
cdf4d3ed234e16e27f2669e899601cf7fd5fdb01
-
SHA256
8f536b0a6c6413306c3f5d51dda702d52d2eeb4adb6d8314b389e71ea00390c8
-
SHA512
99a8779075a40b353d8d8f9a3a7f8852b45e7b32775f313fb23763f96f52460501bf082777695a6b1ad38788d19d484146008b59dca472bf60934200685712af
-
SSDEEP
98304:iEZ0LPxmvw2WPeJ04hD1RZI6yue228mHIxilnq0HfrycVJQxnTJl:iEZIQwW7hD/ZLy628mHMitqKVaxn1l
Malware Config
Extracted
hook
http://85.209.153.135:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pintek.zore1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5509b45aff6699ed0322d494919518be1
SHA18e72e7a882834a0718ef4645383dedb153b43a76
SHA256fee0dba8c365f83ebb40d028db30bdd2dae9c515d7463eb00e499352ee604f8e
SHA512bd29c4c922f9f0624f5efdf6f2f866b1eabd104ae488ce3c60ae782d67a3507c012b03b6770b35bfca2519532145a947732592227c4fe4853f8d086a96a76c74
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5765b0142506c044add6d3e876b44a2ad
SHA13b4f04ef2221cf42aeedb40de2dccb72d952c1f4
SHA256f271bcd56c53c76aa2a9c929e23a742e032c03fa7584027aa71a06a8fa4d8189
SHA5121dcac84f65a922c0bc15e89c19e4164afbd06c20003dce022664ef9eced8072bb6469a45846635b6ba5d2ee9489b9e183216ce28ee92188303ac840f15d685f2
-
Filesize
108KB
MD57cf6765ef03fc1fd218c108a8f87db5b
SHA1a79a2752e8bf147162b70fec6ba960a99b4b12bd
SHA2562629673c3edec5d62f81701b338fe0d4ba6df3384d4f939f3d55537a074cf0c6
SHA5125a4cf5b1a4412672f91837fb12463282fad8d0b3dc93e58977d9b5645ce71326475d4406579fd29002e25e945a4b5bdbd6c716220bd35818b6d5dbbc3147175e
-
Filesize
173KB
MD5096b2c66c8f40d554284cccb271cf710
SHA1a3ff789abd80184d9cb0365e6a37cfa31e4c3dcd
SHA2566c696a3693f8c43d0eb3b0413ae6f18b8e44d4bfa30447b4b6058a8643cee72d
SHA51213383e8beb49d4368525dbd82da8ff562a9c924cee6f095ba4ba1be692b7a337a2f27150ad5638ef561879c7f41c8df6742e21d806648808bc25e2e1ac086465
-
Filesize
341B
MD5b9c168a517c3ff28f57184845eacfd7b
SHA12ab9b8fe1976496ef363fd1707384b7576b860db
SHA256afcff296d8da053f63b408a1f6782712d5e87803503c7a1c9a3d953c0d25721b
SHA512530162a987d84e30e81d07d95f89c8b2dde578036a4733a1c51d63555f4f044291ff381f7d0b2e89d57e1d8787155ffbb7a71cd06a2a1bfdc6f882d53297d1a4
-
Filesize
3.4MB
MD506dfc829bf9345876f04db7b69485799
SHA1afac2a96af43bfe4c6db99fcf0deff352a4f5a70
SHA25677909b82bcc2dab7e432d0547058313c5bcc5ea298de628a6ae05fb9d39d56f0
SHA512b57fa956d0afa8dab830592a42692df3577cd7d1479f9beaed790796951eeab2120619ecdc8801006e3a607dcdbfd8ef2592436fba19f838d1851c42948dc67f