Analysis
-
max time kernel
179s -
max time network
191s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
26-08-2024 22:02
General
-
Target
595e418e6bdf6e58ab21bf47021e3b446efca3e47e1bd169912c82a0833311e3.apk
-
Size
3.4MB
-
MD5
a075ed0583a6653a140b0dcf827a9f53
-
SHA1
5d48b6ee09462e962ef53126dbee339b1f02998b
-
SHA256
595e418e6bdf6e58ab21bf47021e3b446efca3e47e1bd169912c82a0833311e3
-
SHA512
70e92b1831e97d572f30fdd89d7845bf9e9650f6703a322890548f3c6b68867d4709eb2e92bdfa647ba14d1c63f3abfd3cf7db7b64c80c5f1d57d9031a3e51b2
-
SSDEEP
98304:4E0QEpGjQdspdEIWyky96tr04kZhCtRbvmsZoN:4EpEhdid6sErCCtRbvm9
Malware Config
Extracted
hook
https://ws.holenomolena.online
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Reads the content of the call log. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD58d26a1273fed28bd2083fc2fbb7f6e12
SHA1c6172e99a1663754b78555a1cdb69f96ce9700a3
SHA25600355a9abf67133e11f51523501b7f7e62b101a28d630250b0becdaed05cddba
SHA512e992cd1961f1e2c01f6eb9f3b32dfb52b56c9b0a120e01a37dd5518f9b17eed0f3770c46806dd5754bf274737da7ce333e8fee68c1489db2ad3b9a174f80e742
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5277f00ccdb3c12ecbead0668d8cfe408
SHA1a4bd88c82562d559775c7e0df64b0d87b8350380
SHA25673cf1e6bfaa4ba5be6e175e4dea4776b4040a71521fc95a8e266b6d8c9846e54
SHA512b46c00810bf6148cf7420c9b514facf97986d5194b5da5334ea2f5da62fc2b8290ca79bf66556c595e0c25844ae4c00c91f64c451df76f223a32dee361fad19c
-
Filesize
108KB
MD59ecd8f4e91d6044c3135d7c47d295e44
SHA1a5aa673e6e5512445e64dffd6dfcd9e80c1d0320
SHA256078bc5c4a19eb10f671e8c52fed24e6c7eb82d522682ffd33cdf13e9ba22b670
SHA512864bd129f4be8d6eda8b26221abfb748e3fac9036ec3731965af051a2bb0442f47e0bf89e74797eb92469b0c5741592a55d9810430695c5e5687c2b0c1b30d82
-
Filesize
173KB
MD56aa9eaa0ad7f5d838c301ab43f7e4d9a
SHA15344fe343011ba73a8b6395935ffd6d89f548167
SHA256e7b7b7f942fa1f9090f3ccfc8f26a3a426d5c8ca6c1ad49a63be52c645710bdf
SHA512fbf91ce102e3bc5e68a21da36f3a06eff0512b8af4cae6f8f9c0cbb23615ef690f548795843ebfc5993936750165f9db0e39825ebd6b777d8fb08f190c88fa0e