Analysis
-
max time kernel
179s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
11-08-2024 22:14
General
-
Target
896b6c8d9840cc5df2f6262f1ee52ef66a6ed57690dcf1189f09590a1b12b587.apk
-
Size
1.1MB
-
MD5
d0118dd15f0c4ba285f02a559ac25221
-
SHA1
049d35eba26a5c0477db06c1948fd380bad96918
-
SHA256
896b6c8d9840cc5df2f6262f1ee52ef66a6ed57690dcf1189f09590a1b12b587
-
SHA512
a819129132b61cea7a2f0e8a695aad4334787c46e0bf6536f24aefe6f9df4fff330150500bd98c25539f3765e276f363857a0eb0daf4cf8b880186176301e27f
-
SSDEEP
24576:M9El7zYeMRiHh1SPt6bheG8mvofK8XLrv3ojycJYg/vjKa:WEl7zYHUh1HlJB6fXWYg/ea
Malware Config
Extracted
hook
http://wispy-pine-99659.pktriot.net:22284
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.bihopomiwuwo.xuri1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56ea52538e5037a65ff4a145c2bef20f4
SHA1024cad518028f5293d935a612f74c87489c60d30
SHA256feb3a793947d0064194f0ef8af9bf887d81931fd90a6bd0f9fe5ed59eac1c085
SHA5124ad9fa7a5784ff969067aeae89c506bd7f099bb5af158eebc25571b9214695d21b5879b32dd6d112fbf61a6710c921b5c35c23a035435ec43db5278bd8a2c4ab
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD53c3e839d36c63e829d871ee07cba9c14
SHA14fb889f65e91444eadf5cf016e80b7ee7fb6c26c
SHA2566d0948ccfb3479aa06139abce44ff24bd5bafc569e8cd6238da211c3b074fb98
SHA512afedf7d316a6fd8de93127286973b8accd43954ef7e0de2d65aa1727c03e227639ee4841d4ef7686e713711bc511a19ead56258bc332d15261a3d0e005050e95
-
Filesize
108KB
MD5137bd45743f958a555c190ec46b21a8a
SHA13de3d1c40174e12091f4296636bfef8ffff4cdd8
SHA256e7e113dad2a73ce7fc76db1ff92aa5f12eae178f412ad089911ae6c8b8db4856
SHA51224f128d5d1f3794cd66d941fa09d797e584fddb7f320e4a8bd2d0b60f6bfa8ad105e176360ffd3ef5f258327b7c3e3374bd493803173f8cd0db2c0a76cc82f5f
-
Filesize
173KB
MD5456dd30aa005502dae4969661b8e00d2
SHA1b49a86f9febaa91de428b03a418c49170db98b6f
SHA25609ff2bdd9feedc46563e12f1c557af583b85c027f43d58e8af3302f8445f302e
SHA512db78cc0fcf59f4507976d2279750282448e70e7bce7f6fc7934a7e3e085789fbd43349a4927d4277399994997147a20f1b6b910ed9e01a19cfec5458cfb4cfe0