Overview

overview

10

Static

static

6

8757261be4...18.apk

android-9-x86

10

8757261be4...18.apk

android-10-x64

10

8757261be4...18.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    09-09-2024 22:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8757261be437927bbb7f0cc23381061311c407e81abb6ded542faa43a12c5318.apk

  • Size

    4.2MB

  • MD5

    8a52ebfaf7f83173190be087c3321eed

  • SHA1

    89ca74dbd4b1fea4f5a121eac91841e91bc60578

  • SHA256

    8757261be437927bbb7f0cc23381061311c407e81abb6ded542faa43a12c5318

  • SHA512

    358f0938171f8baec1ccf3b68a7eecc9df273dbe354be7753f4b231364ed1b8b0a427d49b1b2ede11c293e6c357aff3f7c996f71dbd3245199ad639e6b481190

  • SSDEEP

    98304:ZIuZdTM+JlZedlo5NFYEWEeDh2u20Z1WpfsbPQtaThWH:Zk+JlZGloLJ22uzrJQgK

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://134.255.180.156

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.cowwkzbki.musaufvfw
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4217
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cowwkzbki.musaufvfw/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cowwkzbki.musaufvfw/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4244

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cowwkzbki.musaufvfw/app_dex/classes.dex
    Filesize

    2.9MB

    MD5

    e121e7c17186aaaed8fa5378a1aae1ee

    SHA1

    9e0482e0f3a29147bc5f033c54d0e29045e940d6

    SHA256

    8c9a97d26c4881f3ffda54f5a2120dd70f854a37b829f8a13a018a1fa2aacd27

    SHA512

    52fd3750fd4a90abfb77804ba7e652dfd6a1302cb981a7cdaaac194e2836a228237a76909a1407f0394512471b3c6509009954cc9950ed82f68141b22bf43cb0

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/cache/classes.dex
    Filesize

    1.0MB

    MD5

    3fc088e1357b927bcdaa95d749402456

    SHA1

    1484a488333ff4b8f999f9c30e3221fa3be8fc91

    SHA256

    2f5b98535cea266646da75921f489166c91774a44aea469361a47b0a9dc8de73

    SHA512

    0af08682bc3d0987c6ba074fc4894c2854dcec99f8b6f8ed9f3f16d0d374823955da3434f1ef6395bbb1c37f16d75fc63c59c1fd14d2917d929e3b9f32447b79

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/cache/classes.zip
    Filesize

    1.0MB

    MD5

    0984297e37da6c17d5270fd7e682347b

    SHA1

    f3f2d6009895eae8aebad8b5ec995ce55fe3aa82

    SHA256

    97e0b2417853ac66f387a4e3b6b4c641b6aa984bd6cc19b20b11f85117214728

    SHA512

    85a3997f4bf61205e434eed5a6e4faffbb2e16097136911070186b480614d84cf8007f040fe2328c1b18a146c840ed552a64006ac8bea6ea4c40b543d3dd3db5

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    53f7e158a3ef922255785420574fe402

    SHA1

    03906cf1a90b41b3f96f0d8688be05f7359dc398

    SHA256

    49c0c9cd6b7bcbcc5eb928e5bb9c9b54451046ff17ffb3d77b69fd1a73ba7a80

    SHA512

    025a27e6b45ab0e620050e624230c1162b28f198620c38addc4c1d1d153609449f47d8f1a6d10b6c8fa96a7ca304ef65cb1ccf2f7db5f3c622802ed9e293a997

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    8ec35e1d16e955350a616cadfa336240

    SHA1

    a63f880956dc9d771d8cfaa5baa34ea52152065e

    SHA256

    a5bae1a468788d960683bfd600436f7413add77cc825f304bb5f529950829f8d

    SHA512

    d28b0e9c945cf26bb83ad795b48d667c19576a6cff659f5926e3fc164945f12a8d5a3fc29354c582d7fc619c5c65294fec6b90eb5f4b3f4cb18fbbfbdd694dd9

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    de7c404c7fba50a0d738eedc47782dad

    SHA1

    917803788d6cd3611859022d1b5ade47a2ca4987

    SHA256

    e61eb53bcadda3477493b3b44935a3918e81f2ce80aa417004b5d617d154736c

    SHA512

    a189c88ce3db3cc69871d2aafc329eaa3dc691ee7c22af33f538fedb41bb12baf9d8363cab352443f8a85b707271ef26a4f3112b9086206f318ef2ee862dc06c

    Download Submit

  • /data/data/com.cowwkzbki.musaufvfw/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    0d18641ab408b981fae925ded1ad49f6

    SHA1

    8e19f0ab505d655558c6d9c9b915e1046ef5129b

    SHA256

    82fa9c708536894586313c0ca10a65b1639d7fdaecdb9a2e517b7c234a518a91

    SHA512

    6693c580d1c07ce1f4bd1b103964a234766f0253e258c39c75641bdab39147206256a976755074daea344f5a9aa8d2a31332c523f86d9894a2b7bec59ad0389c

    Download Submit

  • /data/user/0/com.cowwkzbki.musaufvfw/app_dex/classes.dex
    Filesize

    2.9MB

    MD5

    117d112cd465eec9ecf19a61dfb5c268

    SHA1

    c3fc22fd07e9fa4f7429c4dfda9f13f3b82242e3

    SHA256

    0fe796d45d7e5e44985a1d960a2e7f27a505df45abf6824bedad4c5b1dc3cdcc

    SHA512

    4b3c66676673f3609a133221a7f82d458e37f90ebfb62a48e2b0268c27706a96b31460adfe04ea779c11906284aebf7ab657a650cce89f7dcb453c9db95d8961

    Download Submit