General
-
Target
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67.bin
-
Size
3.5MB
-
Sample
240807-1wslvsybpb
-
MD5
35df01a317d9d8451b77704d427d880a
-
SHA1
30b6513efb873493fb30517127e23318cd6a39f4
-
SHA256
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67
-
SHA512
c36c6081a33d33151a97a157d8885af65595d6dd254e9382b4e7617e575975140796559d247ff0c8403f34b3481a65dd12cf3b8bc25ba1b0fe46d16b5ca06b11
-
SSDEEP
98304:29eoW7f2zsltpXo8AVY2c+t9OD/7g4XK8zDWloEx7HWLuf7sNtXPY1p5o7Z+:17f2glTHAVY2c+p468PWvx7HWaSJYrO8
Behavioral task
behavioral1
Sample
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
hook
http://91.92.245.16:3434
Targets
-
-
Target
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67.bin
-
Size
3.5MB
-
MD5
35df01a317d9d8451b77704d427d880a
-
SHA1
30b6513efb873493fb30517127e23318cd6a39f4
-
SHA256
6f55daf164b6a604c62c6bfcda9c0575ce29cfc183d5156a35fdf82761d57c67
-
SHA512
c36c6081a33d33151a97a157d8885af65595d6dd254e9382b4e7617e575975140796559d247ff0c8403f34b3481a65dd12cf3b8bc25ba1b0fe46d16b5ca06b11
-
SSDEEP
98304:29eoW7f2zsltpXo8AVY2c+t9OD/7g4XK8zDWloEx7HWLuf7sNtXPY1p5o7Z+:17f2glTHAVY2c+p468PWvx7HWaSJYrO8
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-