Analysis
-
max time kernel
179s -
max time network
186s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
18-08-2024 22:00
General
-
Target
abcf64399e50efab7bcea29c3e4b02780b5d36dc47341b36376b0f81e40aacc0.apk
-
Size
3.4MB
-
MD5
b61cd9c51fab2c40792ee332e13d521f
-
SHA1
a83559c042008e793ef5f643ae5ef5c1ee96b8dd
-
SHA256
abcf64399e50efab7bcea29c3e4b02780b5d36dc47341b36376b0f81e40aacc0
-
SHA512
fbed90fa2222f9ec720da882c9b31282faf4ee725887388700b4c3225dab66244faf9ec507705d0352789820d4696f0e65f766903d3a3abc8171bd3fb4622cd0
-
SSDEEP
98304:9nPrS2qV8AWDV+TE2tDpXhtlWsz3GAhTWY:9nyNWDi9DpflWsz3GmB
Malware Config
Extracted
hook
https://ws.starlightsymphony.shop
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50a9533fcefab2c5548264aa456ef6b2b
SHA18c52018a5c8cd7dc7379c4dd0e024e1029bcfee4
SHA256957aea385bea8a063152f149f929163eec6421d57c5413e92a6686ce6332092f
SHA512f4cc00db8718d562453cbb59f1a79f632192b5af2ef7369c3508176507fb7e6f4a825abfacf0543fe96d962022b717a4d262a7565c4edcf73e77e73947ffaacb
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c6dde07570577fa8580c2aae9a73fd69
SHA149c31ad80ee12e33a63c1e5c9a9f9c9416187f53
SHA2566a514ce249e905edd8329c8f4d01163824f03a48a0d781a570b848022700587d
SHA5129265d27db3b8419815933273722127c49713fff6a8b3f9aa2559da57ab74a3d9d5ef0089e599d74dc78d3b6d36baf21f54c716c78ed0269c62fff8e6419f328e
-
Filesize
108KB
MD554975d2803adbc070e53a763ed73e70c
SHA1c5dc6ab0334cb9fdf1162cedfcf5a347945fac31
SHA2561b19300abfd6d765701cd177b1f9b0e4bb4275921ce296ffcc12859fc620cbc2
SHA512bdf194f8e4b3367a4dc9b8c0792ccb769ccda983c14f75e68851d8fab93d0c8e0960dd0810ce974beec7672b7016eb3dfcd6f18d22afbe0b1bd8cc0ecb97558f
-
Filesize
173KB
MD5f7bbcc75ff55639d9d641b726bcefd2c
SHA15e53cc5c3e397e33c3524324cdc02af0376460ec
SHA2561697ee232b4ca76bbc1622d1e7d41184bdd115b1cd38736499990a9e0857b314
SHA512b2cc0146eda0cc66ff1a2f21a9bd8f8e220fbfbcf30d9fabd75d4a58c2e35426ddbe13d294141dae88e58b80801e36a38dace27bf54fb813f50974e263fbd131