Analysis
-
max time kernel
177s -
max time network
188s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
09-08-2024 22:15
Static task
static1
Behavioral task
behavioral1
Sample
36a53adceb13df0e9dca6d6066d35baf555be6e6c885074a5a8a9e15b26fc914.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
36a53adceb13df0e9dca6d6066d35baf555be6e6c885074a5a8a9e15b26fc914.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
36a53adceb13df0e9dca6d6066d35baf555be6e6c885074a5a8a9e15b26fc914.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
36a53adceb13df0e9dca6d6066d35baf555be6e6c885074a5a8a9e15b26fc914.apk
-
Size
4.2MB
-
MD5
eaa11ebe174caf9438fe736ee2963b20
-
SHA1
26f0d3e7c8c0bbcb73b731d7d54671e9cf140d65
-
SHA256
36a53adceb13df0e9dca6d6066d35baf555be6e6c885074a5a8a9e15b26fc914
-
SHA512
c85fe9c23b5d66fb424e2c74c2684eeb9d06b82c422228475772965c2f6b87fbc5f891840b1d1d0c4da82390490b46453ebcbc3a27a1cb9742dc1f25295dfbc6
-
SSDEEP
98304:JZ9D9JOqybDCGLrHrC2HWF0bouSVn99YfiF4zt:JrJoquNHGgkVvYqaB
Malware Config
Extracted
hook
http://si5sa8cv.xyz ; http://kvak75vdg.xyz ; http://mo8ma55v.xyz ; http://lilisa5ra31.xyz ; http://hiro59su821.xyz ; http://bar471jdn4.xyz
http://si5sa8cv.xyz
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.tjttpkntf.flximtrtf/app_dex/classes.dex 4260 com.tjttpkntf.flximtrtf /data/user/0/com.tjttpkntf.flximtrtf/app_dex/classes.dex 4287 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tjttpkntf.flximtrtf/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tjttpkntf.flximtrtf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.tjttpkntf.flximtrtf/app_dex/classes.dex 4260 com.tjttpkntf.flximtrtf -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tjttpkntf.flximtrtf Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tjttpkntf.flximtrtf Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.tjttpkntf.flximtrtf -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.tjttpkntf.flximtrtf -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.tjttpkntf.flximtrtf -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.tjttpkntf.flximtrtf -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.tjttpkntf.flximtrtf -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tjttpkntf.flximtrtf -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tjttpkntf.flximtrtf -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.tjttpkntf.flximtrtf -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.tjttpkntf.flximtrtf -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.tjttpkntf.flximtrtf -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tjttpkntf.flximtrtf -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.tjttpkntf.flximtrtf -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.tjttpkntf.flximtrtf
Processes
-
com.tjttpkntf.flximtrtf1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4260 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tjttpkntf.flximtrtf/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tjttpkntf.flximtrtf/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4287
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD53e85ee9a5053eafa05c7c3f28d422d14
SHA1fd496902603e4d6f6fe90879b810d623490fb8f5
SHA25628e2f9a1484085139d3051608d09a96951d5dae54d5ff701864a14bbbb44dfcc
SHA512d720d22ad8347c537a4bdd92f44f79237bc20e298f06aa2ebab701084c54113f8f9aee5906935500f19b62ce7a92100de6a6c88b59ae1cded067716256533523
-
Filesize
1.0MB
MD55d13566177c06a8a0b2ad9c6416694af
SHA148eeb7b5582dd9acff09b167c57818c0ce4bc8ea
SHA256d3eaa96ca70a498c2ce5743ba3fe33a7f4e46b8e183b74b5ed92276dca956488
SHA512b88b6d580e4192a632146a77aac73e30652d5a8e740562ad02a2cf6fe7428f7093b87a3de8fad83788a6146963fd71dc4289796c5f339f6c5c8ded541b776185
-
Filesize
1.0MB
MD5317ec70fb1fe1211537aaee22bf75780
SHA1f873b60a3372909e49e5a3f8034806ca2815c74e
SHA2561099fa58c7601883f3f43b8efdc395009bbac6d40d5e56a3aad9d6c30de29208
SHA5122398d19c0841844693ee9b61925e42f914acbd443211dd7fbafa11f0375339618c3cdd3df3907b905432553791684cb9d787cca134a29199ed6495ab5fe9d808
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD526d7cd27cbce76f0fc234691efd2d18c
SHA190aaf9c5a44f4b6037247ad75258225ad7e48e33
SHA256ddcbb41891aa9922ccef8185b678d0f281298c5adf0322134256c2d473346f4f
SHA5125fcecb688980b64c83ce01e5f117707c17d81455c4378cc89e318a99be52c1f16da19efb0434f30824a9bfc742588eb75bfb1a96b071676a2ae6b3e4518b7bb1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD53f3a53e707d81f8c6cc2c7352abd2834
SHA14bf8d6012466dfae24f5a4bc2354c9e3fa407953
SHA25692b8204c69bf54ca3a1ee68f94663da58b469a2c310b17026713e4758f63595d
SHA5126f897a4e751ce0532aa72cf8deb9210e97f1f29b504157bf18ac14bc9cc650657774a592f0693956e83ba9604a580b420761d4106ba7ce7221b81e4db3cfb181
-
Filesize
173KB
MD5e745e04713cf58805f7a3bc90b9ac9d7
SHA1c88a2a4c5b49ca754f679f543ff73c99ee20bbca
SHA256db0d6d766ecd5e925753944fc2ea249696e1159e2f6faa8428166b803f04dd1a
SHA512689692e3689be9a0318a2d7230252ebdd1192e289fbcec094076542c6d541aaa0ac92a2926a6f729e9c0add6956faad1f3ca08efa247ab622f1e0b096e64a630
-
Filesize
16KB
MD5e81e86e4fddc047ca262fed37e076ee5
SHA1bec4ed8921cf40712cab4fb80d3f653eba0fc533
SHA256843ecbf5f27af549ed36cd95c7c14a8a910feb4a03886f49e8ecdbfe53665ee3
SHA512fc5434c4111d01b0d060761df8fc2e209476885d581ae12e7db0956932a8d8f521ebdf33599cec895aa8a3c9213ec689125f1c2507f2571a3f527c7ec66aafbb
-
Filesize
2.9MB
MD54ed996db3780feccae45dba1401a6780
SHA1b11de10077f12433a7366527501deafb66b414be
SHA25633c9127ff24c8537bcee131c261b9fcd9a7ffd99709c37f899dfcbbe092423d8
SHA5121cec7094dd500bf999790a354922abc80ca3e7139b2e8c92de0bcecf7a0acd63269c5d33639f62125c53724976bf5b71d75d2478316a7ea267145abee1feb88d