Analysis
-
max time kernel
119s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
11-09-2024 22:03
General
-
Target
5de9b18eb629991bd38a9b22085528dbe5c2b3e5abb79648b8a9d7bf706c4437.apk
-
Size
4.5MB
-
MD5
9d5629af991b9f6bbc86ac50414c0ad3
-
SHA1
ff1b949363e5f686e28211a5518fa0bd41c14ee8
-
SHA256
5de9b18eb629991bd38a9b22085528dbe5c2b3e5abb79648b8a9d7bf706c4437
-
SHA512
f26518fd13418f55b44b4289e71bfe2f80d8ed30959016820e4986c7274b369aaa0f87f0dea5ec78375c5fc2488683369fce66d44619b00e5107cd8e6e085e15
-
SSDEEP
98304:TMMX0EU1WCo9yqhyT0p+COx118Pe+a1OLHkBypAw9vJr1YSvsb:TcibHfVOxIPe+asoAp9JJJVUb
Malware Config
Extracted
hook
http://185.147.124.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.yzlvmrqbv.ruqgfhpry1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD52d10abaa6c72b86efb44fbf62c8c5c88
SHA10084afcc3b1ea93ee778968283f4732af685e091
SHA2568b7dbd90277c5f6e1241534916e62a3ab918fb7abbdb5057c0218112e18bfe20
SHA51291cb08b8439de750ef6d94f7c6a1a604cf4555f7e6d9dd6135843c15724ebdf60befda16cc443d24e8f4f6c8df9945e3e324fab212571347492ce39685ac6491
-
Filesize
1.0MB
MD55410574df16c6692a231cb7d9ab6043c
SHA103b108a9a310ba9e77b764a89464667343c6de15
SHA2568ff42bd8cdf087458edf35316bef720cbe2c7f6b7e34f7b98a3fde5d086aba29
SHA512db8b4b1924a9434c73545c2ace43fa83a1316ccc4f7a4f5622db34134d83a0a42ea7d167bdf0b7e255f73b945cc078fbdba0ff5b4666d1827695221540af1bb7
-
Filesize
1.0MB
MD5792b8ee06333453836e7d853b66dddf3
SHA12107527d5b32d6182181b831d4ade89bc37aee6f
SHA256823e0dc79d607ea7aece5a4bb9608986d8760be7d6f850c7ed94b82af6098847
SHA5124f4f5455eeb8692c23b29e5d3ec7382c97d19b9efbce1de340b9101dde3bad4a96321184795de86b51999e724184854db599175836b1e628bf6e239cdc903b3a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD576699f34ffbdc594e6cd88806089221c
SHA197084571f88ea7c5f1f7c6cbea1c2d8227f3bc09
SHA25696377fea02099f036b48ca699962092dd948eaf432837c79e0819d5595f313dd
SHA5120897e53abc02a482339d45fc00ad458c0ff1cf51dbda737289982e8afb9a5040506f4c7aa05c1b88c804f03cc5887e348e9543ff9adf244deea2be709b2b3768
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD50f2a7b601b70f3647a8f601d635b79e6
SHA1981efe61e8a61219e9b9e7892bed893d43b308a6
SHA256c3bb5a66e7e0b44ed030945495f731950274a2693f4a07cc9b7c9cc3f49b1417
SHA512d6f2b78448dd713123bc925cf2aa2eff259da64f9adbb2367f07e1773931eaca6ad46b22ff735e9963ff6b79e3b7b7a969bb0a4510c086aab79b2fc1ef1cd194
-
Filesize
173KB
MD58d69630aaa8e5626afd8fb23232191c3
SHA11aff3d38dbbbe6d3fe7ae46cbce07aca13bc5583
SHA2567daabf846c1de1c1362401191bd69726f262cb8dc9e8094fe8301f9bb0c6258d
SHA512def83f89d76bc4a8c129676852fda06ba8331b0c4527efce3bec04322851864e9fd70846079be167f2b86dac9e9ab228a57f9cc9fe9de3e7cc87324831fca1c8
-
Filesize
16KB
MD55dcafef720b7b39501343e363cc424a1
SHA1898240386e98b59ac15c918cbf89424fb9256555
SHA2566e5ed70b6049ce8979263a5cc67487123bacdc282a20c999523500514536af03
SHA5127d626f57bd5c6ddaca0060acf5beb60d192c73244ce4935e3a3df2cfd7e0fc6d3389d66833bddda5a128d0d3940e2f106862fb44a7c38785ebd98ed7704b8be0