Analysis
-
max time kernel
148s -
max time network
154s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
08-09-2024 22:21
General
-
Target
60a2ab1db8e150ab0e41fc21ce1475ac00f044e7bee833584418a23fe9fbe8ce.apk
-
Size
4.4MB
-
MD5
fe234fda06aff37b0e6fd507f5ddc402
-
SHA1
c611af09888bb3405fe91755331d5ef659d5d01d
-
SHA256
60a2ab1db8e150ab0e41fc21ce1475ac00f044e7bee833584418a23fe9fbe8ce
-
SHA512
87e2c49faf3667a66bfb5014f13ed5986374c6b7cfc26dcceef3d245e5b89f8fcd75289ae845e3d8c7da9274eb46aa61457a74b4f89186e419a1982b79f397bd
-
SSDEEP
98304:ifj7uAEdxpUEOD6ASBEYFo8c5/gpjqAESjR:cPu33UF6lFov/gFEQR
Malware Config
Extracted
hook
http://185.130.226.87
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 17 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fdkjwqutf.awnfrmyvz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD592aacccc1996021f65e9db025c4e809b
SHA1e453a31e814e61b3e835f5d6595e9cd2de6f7230
SHA2569b8231e3a28c35dbac4583b7352f3dc294190f60d63f4c0ea4bf386e0436f24d
SHA51232cf3ae22a3873545f1148facc29d0a72ff7c8d9483ab5c25fac9f09687994bf80ebfc9552fcd9ac4996b7500f5fd4436a87f46157bfbec1b9c2a1655ccba5dc
-
Filesize
1.0MB
MD566916007e4e12985a07e7b6272378122
SHA10b408cfb84175e99025394ddab29e3bbe91763d8
SHA256056e21bf7a2bea824cf4218ae68b34300352ef1d6ecfc243845c88ff4a247f69
SHA5120c61f6e57a29738ec70c693dfcf7eb76242c43f05a9c13c7ec22393230bf8e1f61f0dabb046d47a39275208c923da8e2ce4ea82b0a34d6058c8e546cff82d0c7
-
Filesize
1.0MB
MD57759fd0a671639d479d3c37a700cc57f
SHA1ab683973fb34c2d877b4a0d204359d1e74126417
SHA2561280a7f7c6c9deb3f6f8ec594e5ddb5f0d09aef73e52bd18456c0b445ff7dd35
SHA512faa52c7f5c95ac8f624abd596f5727518fc87a3398d58c7019da1a9385a0ebf61504c1de904ddd7b28f901075e079caf06af3dd6e2a1c5e07512255e88b17bbf
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD54c229ae5d37c5852b13232b2c40e3558
SHA1c75b58a7c4d874257adc19d36321bdf9eebfac2a
SHA2569f162993b6a642d12b89decd03018179b77c5e2cb441bf972fd7bef68b0836d7
SHA512b804470182228b4ad7eefb86e5f3bdfe5488b0810cd11b4868b4413aacb44a5b45137d0d9778812b1c68122a6611cc60584e135b4251ac77bb3b811e42be870c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5320dda93ac128c77f23645537ddd25dc
SHA1e504a351ca6bf92a7ab32510b79759d5f8aa39b0
SHA2566f595886e57135f6518d1e75dea1e25bdba237a4c791b09cc8ac61e9a8aaccc7
SHA512d7a7c67766af0f52b260bc43c574a54a81ffed1ec23adce20e92ccef957832b65e36ca47e0b5f83a3ad77e6462aca9502429fbe179186d20520c34d5590afcee
-
Filesize
108KB
MD57a1d09e3649cd8304b4310bea37c581a
SHA1205f35ab07063250c2efcf2bb7e6f4a08dd942b6
SHA2568af557454c30bec53c72031ef4593eba7d3a767600d891f89f6677f5a8b05ebd
SHA512c7a31b6bf889a7be778b4148cc38b9fa143316b90e6d79f20d07de60833e4b46add171aabca3199e34e90b95cec7022d7bde589f7a4962857b4ca01501d12962
-
Filesize
173KB
MD5d54190a787379bab062230113e7e3b68
SHA1afb0ca17be0464ad90acca6c00c8e914e02a8164
SHA256f48b09b44e5cbd41beb17de326e2e13450897ac375c8dd84392829c53cdd0abb
SHA512ad368f182de6c59a847de414c96047ebf9094e383e45a3f9b96b9af03f20907b0c7e1ecdc0853935717b754acf1107f427721b9c296735de4c1024906cb3adfa