Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
09/09/2024, 22:14
General
-
Target
a4b9aa0619a74dcfcf4b4bb13d610e76606c7cb551a9fdc78bf45e737dbbd37f.apk
-
Size
4.4MB
-
MD5
0b7c5967ca8e6251473fd9b26f19fb11
-
SHA1
46b21076e97b2c5bbe977f98b67330dca7dd21f6
-
SHA256
a4b9aa0619a74dcfcf4b4bb13d610e76606c7cb551a9fdc78bf45e737dbbd37f
-
SHA512
d46252ee3f11754600ddc6c7b48b8241cfd0b1e489a0bc665442931bd9c99c538d84e86b221982c9228ac668ac97d07eb108cd2e26c79adae45b405f401b2701
-
SSDEEP
98304:UKfAQaTUibERxhgqDfAaIgXfmq3gQ2fK9cpCCSuD+mWxWjnd1VOJ:UuAQEUiby7gqDOgPmq3gQKCcpCxWJrOJ
Malware Config
Extracted
hook
http://185.130.226.87
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 19 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ncgtpctkg.eanzbfsiw1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD55060e68e2fa658d1b28e18d514d5033e
SHA1c27247f5d015ac181ae32df2c4b889b31fc8115e
SHA256455a988b8371ce33e6ed39bf0c4369c3c9fd26b6002423d467308f38a0cc20fc
SHA51279138601617072efaa8e77171133026aaf24bf4af5df14e2ac69e16cbd8efd4f18843dd1f8458f5ce8fc78cbb578bf0ed400971cc326b30b53b9935bab58dbc1
-
Filesize
1.0MB
MD58391d760410890669979909cf6c1318e
SHA13f44823afce3eaa20ed125913079a62356c2a674
SHA256b47ceef4fb691a856f3e76ae7b6c18c612aef1cc4e01578bacccb715968fe4f9
SHA512bb931c5fe6cffb62dfd8c0e57c7a9ad58b414a6d51342d983608095036dd0ce6420ce5b1da646a58e43b1a8054b09e92b1d32b13a0544409b03a70dfd415e691
-
Filesize
1.0MB
MD58ab99d97e191d7b4d3f33d3065bf0076
SHA17a896180aa15ab8385d50c3306e44e2e6d98a61b
SHA256f658fe00f4ad2e0bddd60e25a1ceb001efd1333546e25516e9b7e0da705394cc
SHA5128129481cb41a2cedcd09d86f161c5469b96d1ca597aa056b1ffc7f071d81bced258c409f879355b8da6a2040c5ce3cd67ea038fa791d4bc3a3a6c5b6459951b4
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5b44e8a8a7ff4f4a40ea1d3dae96c0499
SHA17f9fcfa640a26b313d4d94084b482d5bdecee1d6
SHA256879080c704b7e5c180489c1be04a4bb106e0758bee2094b2cb3a4f73290e07a1
SHA5126b93d1837b8646ff7c55723784eb3d8f0d1148ae909e0e999df3e1e7caaa2732fc7744f440e9e0ba5249440022b3714a336da4d92d33098f8dc5a7f6ef896b22
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5369a05494cff82f2e516089e06d49653
SHA1f83cdaf63ea632381128ace01c0030d401a9d81d
SHA256396ee2800e5d796d5f70b4f5de10958db5c0d6bb6024d4437ff67a3992e53185
SHA512f68ae4932b5ac4e4fde76517ce8223d9d455bc7f67b46c7b0e67b13ab22b929193a92d82d852ccacf7f9d3dfe98617ad3e4af3d74328d0ed451fe9497a0d03a0
-
Filesize
108KB
MD5bdecd238a0eb234494fdfc981fd27e86
SHA1df9db79b9a287662ae7bd7bbbca54b625d2239f3
SHA256a6d84ce33e0ce484d1ddae8d95fa64cef21af22e68b62e8d3e118ca74b95b7f0
SHA51208c4d1359e14e609ae86b51d8e9c1b23ac2ac21da6c397655a3ef66554a1b6b3097a95f07bc931ceda6389ebfbde3138c95037d4f5732b1462b45ce2fe4052cc
-
Filesize
173KB
MD54d19ff9225e58dee59f8e02a2d23d594
SHA1a8a67d48d62a317f98d2fd6dfc1556db3ed7e23f
SHA2569633b21d090750f52be808e40d283b0acde44a870dd1228488ed81a623c17263
SHA512de197721acb2bebcc73d67cb5acf68781da95575c109e34dc210a97a8ec4fba966930fcd2505422b024cf0dee0c47d41bb11d3a519a474885e6d5aef60b8dc40