Analysis
-
max time kernel
178s -
max time network
133s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
28-08-2024 22:05
General
-
Target
bf4a811f1b2674ba3ec2b4e3d262d9f42e7a8c04df0da07be94a79df9ea04533.apk
-
Size
3.5MB
-
MD5
d185c9e746f000ee4e096706dfeac937
-
SHA1
645366d1f5e6d78df929f4c4edf9a69427d35e97
-
SHA256
bf4a811f1b2674ba3ec2b4e3d262d9f42e7a8c04df0da07be94a79df9ea04533
-
SHA512
e73b72807b42ad1cad9dd098dd776c1c224b375da88e89abb8157f8a44b2effa75c6d41f464b51273f852e2990ef0ab33760b1b2af5d3e17f5bff42d23cd54d2
-
SSDEEP
98304:UCA+Kawfvf4klN/lp5bWrKr2g4YS/IS71zIVV23Zu:UCsawfnBlNdpki2g45rJ9M
Malware Config
Extracted
hook
https://ws.holenomolena.online
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5a46c63e3fca17e486dc0ab259f25bf0f
SHA193932422221ceb5a120a0fa24418e0c54b17a660
SHA256a585b03caed87a729be8fd17f3afa86733b5acccbbb0954ffbec50cbd843bf62
SHA5121de5c06e1d7c32472a4964b421e5d3094b9de4cc9019fd561109ab35f94dfecbbeb63ecd1c44606d1340f9b19873d223922957e43f366e91622cdb3bacd92142
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b85e7e46ff57648d3b4b0ebb19f91330
SHA1ee0cb516761da46c4a0fa8dc7c47bc359cf49cb5
SHA25627aca799d813bc480eada21eaf79ece3c13f687dfce218aa40c4cf30287e8a6c
SHA51296a456aea2cb8b540130285a4f4cb231c5d2d1a421f03e212fd848d99a6374042b1856b95fe1b1808e0ee9499e63cb0ad230a47f565365714d2bbe6a5c20489d
-
Filesize
108KB
MD5ad9c0e0c8b430edadff7d3233b33887a
SHA16189db9b6f634ded6c0d0ba5fbc4e6c0f351f6d7
SHA256be39f5507f20af1142cb8b060a580fed34214301b5e97a026abfb916b3285eec
SHA5120da5b171c483ba4c4ab426ec7e81b5f79a09aff3423bfe51488f528220394313d43ab96dee90a2a1f3b1936bfde5f0c7f1402669b35c30bfa3bb58b4a10e1805
-
Filesize
173KB
MD55b343d136e71ee66986e99cb38480fe2
SHA1fef2f1aac676fb583050844b55c37960bca996dd
SHA256a3d8fb727d88d6fb7346d17b091cd04b18ca6a3e39f62e3990f21385bd930855
SHA51286f033e84320b9b64e5a1116ef53998e620acc68178676a8a3cdb5589dd1a524c8795e41bc697e0a0511eeb4d40134dd228933c89de3fb7fd8b543d6d1b35974