Analysis
-
max time kernel
75s -
max time network
149s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
10-09-2024 22:04
General
-
Target
2413614c65aa57d7e28177706be1fe50eea04c9488984644be7e3478855b1120.apk
-
Size
1.7MB
-
MD5
e50727bcee795f3c02d79977444a9a4f
-
SHA1
f0c53fc2225cccc71d875cafe0782c166745213f
-
SHA256
2413614c65aa57d7e28177706be1fe50eea04c9488984644be7e3478855b1120
-
SHA512
cc008c0aa4103b3836f61a14b2537f3a00ef9ef6ad3e925bbff8443b64cb84b34617eb80bfa4ac84bb18ec2ba024621fb85bcfe721f9a0a9e2c54f915208f717
-
SSDEEP
24576:jCuvK37eBIV3caDPe4LnwiRp+QTJFsj25Po4vHMqUAKyeTBg/BKOv8n:FvKLXVtb9TlJk25Po4EJWeFg/A
Malware Config
Extracted
hook
http://134.255.180.156:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.viber.voip1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD548ee20f48670bc5b00216af738f04bd5
SHA16956a78a8cae8ab8206f4354ffbe4ecb9cbbc8ee
SHA2567e981059e24b8ee099299956a4e005a721bb27154b6fd0ac51ddd25e1617815e
SHA51254e67aa8c1898ec99e5fb9622f2ba004f681625a916789521f0bffb631c812202dfb0e6c2507f6e90ed97ec94e1f165f57253b6c1d7d982f95bbc7e43d3e7778
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5f48f064800ffa8af7a669de5785e2eea
SHA1e11609d4eb30f53cd90e871f18041592dfb9153f
SHA25630c6e9d9fdf3a77791b1dcc8f4a1884b835444267149747c078f66f320f96492
SHA512a71a49468d861bbf0325918f749f71942923b8f64b8e885a3a6c42050c3c03991dabf9c01d1e59cbd14ffcb3fd756ccf07db53658c4b53cd45b2b7c9510a2c75
-
Filesize
108KB
MD5729d7ed6ade64d906d8d02988f1e9c4f
SHA115a158e42518e68546d7dc64de2b2b837ffe9d7f
SHA256b5ef3f21583e3f73d058386b7369e4383c52edaa69a3c90bfeae4c5209c6a970
SHA51264e393a1cff1e21522760f550c96d4a5091f1ec6cc3eef10b72ef2146b94f669ac1430195a6a1f5053e12bd5c146658d0028e1224feb1b1c15be8d31791b076b
-
Filesize
173KB
MD59c029039959b97217071dceb46a4f6df
SHA11850bc175af2284de09bc88e9ccb479e28bb8bdf
SHA2561025798ddc78411f19df0650d883a3c6aebac1ffb00863fb6435ab62d3668d1d
SHA51216063b6da85c0969e3d29e3c3e021e9333b7e3e78f13d7d3ccbaaacaf1d6eafe7accd12587a56129cea47b83528ff80379e4e190d6f687496804505cf8ca2d69