Analysis
-
max time kernel
148s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
06-09-2024 22:04
General
-
Target
c58897c934ca17ecaaf87813feea17de44d42d4e9e4ec21f4d90eb184c7d9224.apk
-
Size
4.3MB
-
MD5
aadc03c102ad328d916341412d2d7417
-
SHA1
f8a625bf3c8400b4976f61c11c08abe3d13fa46d
-
SHA256
c58897c934ca17ecaaf87813feea17de44d42d4e9e4ec21f4d90eb184c7d9224
-
SHA512
c759102dbfa54e74633b97d20262fa9fd7e40655d1cd24ab5c92df135da90c52c932aa6f35e08e2fc0102da94df688b454c3b4304ed18f695cc15e9d437d40cd
-
SSDEEP
98304:GhbOUntjZxPy53+QfyEHDkcnEtVfA+f21/u/J3:GXRvPy53+UDkAoVLf28B3
Malware Config
Extracted
hook
http://193.3.19.233
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.rjwtfobji.qrcordwci1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD51f2c05d48b298777d84f88e2de7e9dc6
SHA1acef604b653c71ac4f58672f66129939e3e04aa1
SHA2562c940012ef578253c88237ebcc9dc9e1065800132589a853df4d44ebc79139c3
SHA5124ec40b17c8060433b8c794bb2f3e78e0d19dda91d2865fab41ac13aa5cc0cb4f93c7f79502c711e893b2e0a7420690b1f355a5420e8bbecba860fa1832e92ce5
-
Filesize
1.0MB
MD56149b0a9724fe3a6008709108cc4c73b
SHA13ac4c5ae607851c0ae6b6a63bd8b8490e894b628
SHA2562c7020bdcd98e13f3de2a2a4b44ec2e2917b575ddcbf2871bf3fb3bae8fa5acc
SHA5125a7102b10bf27375877126464b3e9778281432b436c44557dde0bec726330d9bd2196010f0bc6b759a0e31160e4e4ccc5b136815db37b048c171067bef8e4e92
-
Filesize
1.0MB
MD57325cf26abfe38a2315bf5a99811fe89
SHA1ba66521490d8f5b80c6c88c3c071cdd643cae244
SHA256ee3215b1df3e797e5b30cd86e30a463bb129d1f3224478d188865b4ea3d061c5
SHA512fad3d7b0eda38fa032421eb2f66377a5879608cfcefc9ae71de42f7b5f62099275dfe03750b12d1cd9f402d0d5988ba993753a2fa11f3dae48e0e7a67cd8cfb5
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD54225056503a94983d1f5311d2caaca2a
SHA11322eb4f1573085b4b75e5765ed4a9e45eb2a5e0
SHA256a48826a8ee3733f5acb0cf82c01f2def7f11e707f99f342c84f71de9b1f61d3e
SHA5120c73bbb0cdaa3da69076789f498fa864d11a2b79271cedd9080c7d281c1e643ba47ee461b0b1a154ec82304728b39a2fccb5980a9e84a6e18fc68a08830c879a
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5e12fef72beb788af6170d1134d20e254
SHA1de62eb5f59b61c7d20e1e757f4531004b116e945
SHA2564a16e92be9c80584d36565cd2a4a480f86f2d6fbf8f741a5145152131438d68f
SHA512ca93153a78466db96cf5b1e7c4654d297225634b8aa0bd05c8a3fb5264d2aabf6215e46ce67934485544587f5c6f7654dff4620ba125d3d1998a45bc9e587bc1
-
Filesize
108KB
MD5a6893d2c6efe69b876ba2356c98bfd6a
SHA1df2cda8e09e8bb4856b5f45abda6bc3a3c2133b2
SHA256f0e74216691bfbb7c4ceffb99ace5756c17213444b875e1ceddf33b35a2422ae
SHA512b975df25cb82c6760a7314dd866894e7c17ce4fce47d6da259c6f0f6559b38dbc93d4e31f51623d779845295926c59c214d4797162f757fd11badd8ae7a2a9e4
-
Filesize
173KB
MD5bb9faace9d5e01c718d53dc46fb37718
SHA1d2312cf53a6d768aa1658b170b528fd7364b09f8
SHA256d8b4537d1f8ab69ffc7801736b21592140d8a83a82d92488888400757e0682fa
SHA5123e49329d6fd1bfc1a71bce8d99475114520911d0bcff6591cff2378b3e12dee891cf46f87c4b562cb0bf77fe67fe4d91bb2cb44b87279a200805e0455aa41764