Analysis
-
max time kernel
42s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-08-2024 22:05
General
-
Target
bf4a811f1b2674ba3ec2b4e3d262d9f42e7a8c04df0da07be94a79df9ea04533.apk
-
Size
3.5MB
-
MD5
d185c9e746f000ee4e096706dfeac937
-
SHA1
645366d1f5e6d78df929f4c4edf9a69427d35e97
-
SHA256
bf4a811f1b2674ba3ec2b4e3d262d9f42e7a8c04df0da07be94a79df9ea04533
-
SHA512
e73b72807b42ad1cad9dd098dd776c1c224b375da88e89abb8157f8a44b2effa75c6d41f464b51273f852e2990ef0ab33760b1b2af5d3e17f5bff42d23cd54d2
-
SSDEEP
98304:UCA+Kawfvf4klN/lp5bWrKr2g4YS/IS71zIVV23Zu:UCsawfnBlNdpki2g45rJ9M
Malware Config
Extracted
hook
https://ws.holenomolena.online
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD52575ea7f2f8ab70166a090b8b7413a62
SHA18d9e4d486231e7a046c013eadd346deaefa1830a
SHA2566915575940fb707b80e411c95d9409434e70885eaf3787854f0f541ee2b8be9a
SHA512a138bf22347168b32db0d342a64c274c9f0c3d6211e703a64337c85f9859989b04b90026541a08998b3a3c03897319d07bce96f369829421780f54bc4461e7cf
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5915d8eec91186e73ae20a476c6b9a07f
SHA1d43a96eade88e24c092f780cb2f4b130a9a070cc
SHA256642b24c89be89b01ad50888e7fe5a728e7a057f0ebc73c75a5878644b04a7b0b
SHA5126d95a5af08be554ddbadfc1ea8dff1460440a8887c5f194aa8f6b0a150fbe909b1e25a3d50a414dc11eb9cd422c3765928dcf12976f0cf9faf8d0b02a4174f64
-
Filesize
108KB
MD52e23a6b915c5e5150b7f7dcd853a69de
SHA1ea59a8f8ae29adddd5697de24db63706134ca560
SHA256688463250bf233239d6334f175514cd67b0da1f56c3f914ddbf05f2198e52e7e
SHA5123863c4b02450f15d7f4eed415261ac0d81c8adc36ba43ab25e4d80b78ee4660d798e3d95c308dada8e39665626a0c486e4c9c0e76fb243c3043176d8507c009a
-
Filesize
173KB
MD52a98574ed0d41c81c4431163ceafda22
SHA1f291cc01c6d5b4d083d08da20da69b42e330341b
SHA2565b0fae5905851c84b589c4d11c71f4ea054caf6218b185dac4cb67ae2ae79d17
SHA512541862f568eb125a46576167732a63bcafb9f113c06a93d7f7c2a25dfa0b45eba6a690cc4469c8fb54b0925d805f71df3df720db3078e93ddea03f1441f69f84