Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
10-09-2024 22:03
General
-
Target
4c9fe558e596df0a71a6bb81951ed0e168969a6abad2577a2e852b2431eb3433.apk
-
Size
4.5MB
-
MD5
650efe508156f66adae704c3131c77a9
-
SHA1
ccda853f114d70e0466bc6d05a72be09c4a8fcd5
-
SHA256
4c9fe558e596df0a71a6bb81951ed0e168969a6abad2577a2e852b2431eb3433
-
SHA512
2077d663a552e260ac5f8a2d86cd08fad654463d70e95f850ed16a7b2d3c66d078d9e6520a92aa9b484e80b9789f4e0a819adb2bb8b03e2cfa00f7f87ccba57a
-
SSDEEP
98304:jx9/BJbPgBtQ7ab9GRGH0u9YQmEMOooHKC0ZtZj:jx9/Hsjnb9GwHZ9YQmElLKtZX
Malware Config
Extracted
hook
http://185.147.124.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 17 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pdddfqmrs.mmmpnvgbl1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5598789e4e46eb5bf31dc6a31e390e149
SHA1f5bf17bc80ea19547b222b74af503bfe5505cc0a
SHA25628fd7a5cd9fc1d1f22cd545256548026162972a10caa03cd61c3f89472686760
SHA5123c3c8c4ead3d932465faf336062a4b95ffffc3da0f9b17a86a7ea60c349fd3b6cc7f113ea3ace43445a32fe60888eaba1c568993bdd0d4896f409b2ab75da02f
-
Filesize
1.0MB
MD533f15fe6dca8a3adac1d6f601e3cad6e
SHA1f51682b4cc0fe6ac09c63669080503c82981de8f
SHA256b839b39e82f51a44c7611e3eeca8c0324d1a67aba2631d46592afda0241af178
SHA512b5d3df70f335bab92fb87cb66c40dd6d8dd0af240626c81e641be2c1755358c855fd8cb0247edd9636ad645f1dde1d49ccf4878ee500124ef98eb9bd7ba7a7ec
-
Filesize
1.0MB
MD5f73123d23133e64e151d263d882115a4
SHA156352449c0016138fbc9030bc6d12c8c60a31103
SHA256ffa16e816e00e559b0b6ff33e4bcd83b12c184c18a43e3fca49c79c5669c5c32
SHA512b4ad5a9a28c15d224c1e254eb0047d46bdb8cc29e40cf610410fe5c2fabec8c8978ec20901c7ea604a075553c05d3e0305d8a0dc098da6aff632788da351bd1d
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD510216370aef4e2e7150842471b8e20b3
SHA13d2b9e7223f8522d39ce6c56d77d85e0f0f86c08
SHA256beb1c03e903fcb9f9453e9004f2ce1c68610615a799e8b653ebf41a2c484725b
SHA512e8453a52e76bcecbf31ee746d8dcbba0c22ae2121bc67be83790bf4155c0373af13f6b1ad4628dfa5cc3e9a71d415ef9fe9be702aa9b32e9df5782da29ed217a
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD55b57c752a5c6f60175e36919019bc5e0
SHA1ddcfc39fb886da57b318500d70f2ef52a0cefe95
SHA25694da71abe24ccc69f2fc217d7d06693923451bcc230649044f8c69cca3af8e2d
SHA51274dc34e896710f64e8e57e1533c988835776fb16247ab7bfda2d23cc7f6864af0100433b8adadc7d633a02015173f3849d4a18238a626c5e910417a3c2a34207
-
Filesize
108KB
MD5c569a50bd00762ead92b4c39ddd82f5a
SHA126f3fb1bbf13a6b47c5960e77f7a9044357266d0
SHA2568360cc8d4851aaa81c493cbba310d75a929a599f4c481959dcc81cad017e6d1b
SHA512d87482662fe84998917c84c8d4655061565ae2b03ddd041af23f9d56943e8543ad164371508e812198566468a32f8bd18df73549df7cb8e899cd0cab8ead1b9f
-
Filesize
173KB
MD561d0a2685000a16a76848652dcd31354
SHA1720f63f23dfd3d325514fb1de73251e5d97ffe82
SHA2566343441a5c5ecfa32b1b785f5e21a6eacd6cf8491ebf22a443244bf4d5baba8e
SHA512ce79b3707d601a0e6989cf1121c5a9c3326b728e8c791120db98d93de1e9991a88c82d2fdc1312f724463f7113a352a06dd17373e603e76a3db78236288ba5c3