Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
08-09-2024 22:24
General
-
Target
1524d0f1ba6f88d0198e089916746a5113aa43bc1e66e8dc2127848fc21534a4.apk
-
Size
4.4MB
-
MD5
b0cd63bf5b230cd7c98cfea697f6cc8f
-
SHA1
eace30021bfd0a48a7e305b2c63bf88fab3787ba
-
SHA256
1524d0f1ba6f88d0198e089916746a5113aa43bc1e66e8dc2127848fc21534a4
-
SHA512
5b8eeaaaf0a31cf19d96a01f31db76372b18c878363693898192f696639de9afac9279ab842a0afc7694e917c9413599001c857bd8f3fc70c0a2714d9d197dba
-
SSDEEP
98304:dOJTlzwVvfEBPstapRYzHYPRGom2kF6se7BlA5VLYaBdJGN:dCzwp0PmapRYMJ+2kPe9W5VLY0dJGN
Malware Config
Extracted
hook
http://80.64.30.123
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 17 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.rmptprhsb.nwyhljaui1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5a3c1f2271d8c0efdf0c49ada80aaab67
SHA1f986539664d62adb13eb8c1be4dd8c8b733399c9
SHA256683197920810347aea31231b3139dcba88765fa022dc5edcab54dc1a2b32b8eb
SHA51255d676b2ddf5068c67a54759d08009ec69ffc93107a49128c337ffff4b2684418611144bb52ef28994854a3dc956d90b1f6309c431e85c6adf2b7b3a1f67f47b
-
Filesize
1.0MB
MD5f62f72e50f525973890b6d7dd12378f4
SHA1c673a6494f661afb6f828ea17e462611d0cdb12d
SHA256af7ed57836e8d6eeb7e8103680fc3b66b8a53056f7f41815f340a167221fd8f1
SHA512fc8172e4b183dc27dc6e814a920cb5c282754f6453b636201580fdc6c58885d39b346396bbaf167e712e3b9eec4ea154012344971c8c01e1b08a62c594f94402
-
Filesize
1.0MB
MD522fd06e37fe2e50eb188d8880d6f4bcf
SHA171037998373c123e011a6f7bd0c5c276c079d31c
SHA2563d433bb139535765f2386596d186804bd4552770bb5c17210ae591fedb0ef408
SHA5123c91b96b3ff2ed4eeea19c741a651cba11dc64069d8b476060650a524f1b1baeeb1e9421d22b3a1eb3fc8f3655f21a10823928c7f4c0c9b344283eec28419e0c
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD50c0340cfa2062187ea787e9bcefc00dc
SHA196ae9e685bcd9d7cbe7b1512d486c0cfc74b103f
SHA2560fe28a0ad9d1fe326ee03c60aec94c20912fba800be5fd887fda3941dbb7fa00
SHA5126fd5afc4554e59c903636ef1df9b2e6583d90d30c5178449d8bdaa42b5574b75fa0bad530dc361bcb427f275bace8f41db27c248bc32095006dc8f4ca855cebe
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5020d424982e26acb0a2fcab4c3346b8b
SHA106ae6b25fd29a8a40ab7c5f6a71131943f177939
SHA25644083bd09db1b757b6ada9969f348ab5165d352f8300778a2a8e104db89bd547
SHA5121c6cfeec4407c2aafab6e6d9cc4b5560e6a46b05ba1c0390b4a947a6b4d7872755932b968862108322df21ea489e6be99fabc02f3bcf4cc76c9637d75cbe4d66
-
Filesize
108KB
MD5ecd9df176549e62f3e7550130707894c
SHA1904470a4e9e3d19ae677fdce1778d466a9ee9ebb
SHA256ca3e9fc97ed64cc406c618db24c279155380b2c7d0127955ed2893255ff7d2be
SHA512b0e5708336779927ad295d3daa2278f595c77135ce93522039bc9fdd1ca90c273752397d4a61414d959805ff5a6f9adbd80cec388949ce25648b15fc89e04a0d
-
Filesize
173KB
MD516c9a94335653d1e5f692661905eb6a6
SHA1d4d93d93a4319a58810b3b68468b8e27ceda1f0f
SHA2567064f867dc5b50635c793853b52365f3c1d863c11e5451e5852c273ac04a23d4
SHA5129521ee996c7357ddb6c95345513c63aeae7a5b0103d2efbac5a458d6dcfffc283906a4adc8e07db2b1d850b9949ae667c1ac37f46888c40fd74540c9557a3bc1