Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
09-09-2024 22:01
General
-
Target
9ca68fdb6fcc96fc1725b8101999d638227fc8540c66204c85b3a1a896a57226.apk
-
Size
4.4MB
-
MD5
29be1ff2be84cb99949012c2b82ab983
-
SHA1
fd4b89b0a5f9083b9d844e97d3e3d1770bf16f6c
-
SHA256
9ca68fdb6fcc96fc1725b8101999d638227fc8540c66204c85b3a1a896a57226
-
SHA512
c5d2895d63e066dcf0444b307898525a7b6983947273d4739ec923a3c150d536817e03718ce3dfee79739845391a5a4f1777fca768a8ae88eec1671897496df7
-
SSDEEP
98304:O+DmqkGO8zKO6koZYZbYUE7P8sRZz+xnzyrPSWJXw9MuJ7pXL+BwFhIZegPtKTYJ:3Dlkizv6zYZbYR8sRZaxzyrPSwb0iIIb
Malware Config
Extracted
hook
http://185.147.124.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.jmxrpjdpn.zaivookdx1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD564d0bb27e7959a0da6a8973bd21712be
SHA1bb05efc5fab7283cabf40c5301235c3eb2e2f623
SHA2562034a70d8c6842cbe4c6db26481a755f5877b8790c7c93967696e8c06c3823a4
SHA5129de9dcf4b216efc679187c68a3791dd7f02046fa64c83b48d73d455b8e2004182131759d74ce34977586b081ecc6eea8aa85452311a0ad99cefeb527bafa763f
-
Filesize
1.0MB
MD59014736a1491cd740990892f23b03ea4
SHA17df45baf835c257d33cdd79fabce19f210d318d6
SHA256ca6ad51fa5f5c59e25ddf68aef2f34ae18e08b5e1f488732e5befdebdca40ede
SHA51256b23b4181efe9ed6a3535bfe58048dd1a3fd6620b74539a66d41ad3cd19bb94359711e7bbaebbad68475014fa039dbbabbb6b8ca8833123a3046d51fbc3da07
-
Filesize
1.0MB
MD53298cfeb444f81018af17b8f01c792c0
SHA1df7dcd490d1cc746faa65567165db286aefff7db
SHA256d66c0a32aab9ba685616d037dabc07daded673660d2808aa25a39c5c89ad3c67
SHA512a7cf611dfc105a56e801880d178f1aba0c8cd5ae925e946c301bdd21f85a457b418d9bc053b57525d587e04d7535cbdb959380e034b3eadc6b8c37be239621d0
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5f925b18b1992b56eccbe5bc2867a8ce9
SHA19f0701d81e2b352af09f00ee78773450a8700987
SHA256dbf90d3510802435d2f465015eef8814b1d1e97e294f2145af03b042895d4322
SHA512272fcb045654ea40cd5468ecf5c6f6dc577e8566af1e1c268440f4b76a46a48e46045a25f309301ca8a168e4afa5a75524c17e6c936f20b5cc552d8aa3c0a9af
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD548792f5a60456df6e855d67cb69d5964
SHA1c69812d561c4aa518662c1d0169bbd0a1acfdc60
SHA2564ebd8ab924cf538b9f66bc7d59ef7f6f7ee7a3cbf1efdc730dd1b2185c1eb5db
SHA512038465e410f0919a1dcce831b18362cc600b2895f73ecb0c79292cbb28c74be69d00c7fc052bb9d6233ac9eedcb290309798a2715dae26eb6d163958a8d043a2
-
Filesize
108KB
MD5b8c6fa4800fc2420e95635e84cddb70f
SHA1e442a75485a000cc1663d60266e3abb030149ce4
SHA2569506ac4d510333a73c9aeb2375cbdd2a6390108a01f0e1134cd4d72129016231
SHA512abd0514a7e77ed1d93b064795489c3ccdf8f6f295ea15ae941323e3b0e680d32db6b9917260a024fc3922affce71a1d481f1b17600bc6932bdb4e8056fc51e3b
-
Filesize
173KB
MD528c6eb6f520434afe5e1e2683a057e6e
SHA1397230a7cb9a88eff1c40306377181bcb1e15b28
SHA2567f5590f916852b189471d227cad1306e7546617c7f96073fbc81728314906106
SHA512d7c5249a953ebeaa3da20c994732fee2537e1ad88a9488dfa530ee73132061f2bd01f27dcc6deaf21fdb6c184c982ab5bcd1ba85953758ef36c5e02fda503f89