Analysis
-
max time kernel
179s -
max time network
190s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
26-08-2024 22:00
General
-
Target
48a5f1302df1d1ee4c2ae3c6434443b663aaddc60bcc2d53b471cf554647c583.apk
-
Size
3.8MB
-
MD5
31408747cfc2a2af7cf87626c31d7292
-
SHA1
4cc18c1d29ce8e62bb5ab4847cef18ff514f09ba
-
SHA256
48a5f1302df1d1ee4c2ae3c6434443b663aaddc60bcc2d53b471cf554647c583
-
SHA512
118799d1dc9b9356a0139a118b70a849309cf8981586ce4437598aa8f33d2ba089c560a632a713bde0070889047ca58db33e00d83a52c57cebdb8c369ac07e33
-
SSDEEP
98304:SB3EmiArzk7tzCxVZVphRjQbIXiSUgMnmEC+H9ph1Kw7n8Bys:SB35xrItqVZhRjQb7bgMmEtHfLSBn
Malware Config
Extracted
hook
https://ws.holenomolena.online
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Reads the content of the call log. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5f711152a43f01481cd92ad5fdc1e88b4
SHA16613473a408da73de29c20f8cab9c5035d87ab09
SHA256b23d0e5a7b7f9fa0ab8aa2b4fecb015d803c58a85c5b782e4cf21e3d1f180d86
SHA512bb01bbb818b20ae64c523ff6fd213d6a92bad4497bc45bed6f69842e7b6e66052fa223ff796ef82f0d824a5c8c2f975b451981537d1ba97fc3a6137b30a07b72
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b83237329d83a08e98a8cacee3520248
SHA108172a3ca61b3dc4c2c635fd4066f4c4a229522d
SHA256d1c783c506033a95ada18cf23cc7b1aed2e6662f2532f1118ec760aced201b6f
SHA512c3fd417352656ac831e0258e609db2fd594a98e7a912539e13deafd2f7740640383fa444d644e29e7884433f00c96df13753abe05b4bda58c3e8cc8189db8d87
-
Filesize
108KB
MD55736d320da57fb37b1cedae5e6981056
SHA1daf775eb9c666cd11d2c9456b1861145b0d9c1b9
SHA2561a588c1a392131aa690980b16e8e5c84494f5d2da0a0fbc0b2cab07b01aaae74
SHA5122b5dbd6b392db7f005c60f92ce081b06b374b7ecec57fc32bfb8ab9d8bbbd5942e0c61b3aa4ca073e1b486d5251b5c4472029b191a8dcbadb254ffe18a141e65
-
Filesize
173KB
MD50fe97fde6700a31fdc8ce72060de4845
SHA1fab4f3935e69620c2cfae17645cb7d38e260acf6
SHA256a9df0bf1e99b78a81059f2ee1e82b87ff1cbbf572209de87f221817c06f0630b
SHA512fd3fb17c666f010ada5c2198b86863eb22791b62094ec5e6fd410d57e99f9e759af45e7225453f384bfddc22e3a6c944b1100a3196660c5751455cc888089c0a