Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
13-09-2024 22:08
General
-
Target
4e08b0bf9d8f80edbd91da1b65e62ac7566c4602b31d5e1fc7c659e7647d29c7.apk
-
Size
4.5MB
-
MD5
c4ba4e0834ae3423c083b3c2b1567be5
-
SHA1
90ec975973b0925d70862e72d7890cf76ba65584
-
SHA256
4e08b0bf9d8f80edbd91da1b65e62ac7566c4602b31d5e1fc7c659e7647d29c7
-
SHA512
13abe943ef3a983fa2faadba15e5fd955274ff8bfbd4eb1bd86303f171a4b21ba74bbfdd27253bebd3196fe587683135fd6f11abbf593b6ee28acf9148cb91d1
-
SSDEEP
98304:Il+YtPzwd/hhc62oh8Eue5GFjfrMMPzc6GdhXXvzRNB5Xs:Il+YtP8hhcLRY4FjfrMMPw6AZvlBs
Malware Config
Extracted
hook
http://80.64.30.123
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.isethakvk.atexkdybx1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5e2129fa6a62c50b32f58e2d8cdeaa2ae
SHA1e0f7a927868a243069fa4e19e3e7d7b9a46350ce
SHA256681cad66c3e2d3de7b4952be46510aa2dfef2c20feaa18514472074321bff399
SHA51270753d60a95d4d4fe3ad5d1e37ead87c9f97a194abb72c6c02c27e3e0842969a1be18acae2e6601350fd16a61b549fbe2acbbf514f1a4b19ab7515117d4e6c18
-
Filesize
1.0MB
MD5e3cb1b8783660459b772d51dee05877c
SHA1347a7121dd9167cf655a86643988fb87fd58f0d4
SHA256c7e8ee170c86c5e93d5ee68845251efeb3da79a11b37bbcabe268e82ed351028
SHA51286da101c331acb16bac742bf7824ef99005588e21f2e188483fbc2fd6916f68bd1062f020799a33d6eb096faba5ef7266bd47d97eeeaeefb8b0b1639567626b2
-
Filesize
1.0MB
MD528d7a1a6f071eefcbb4aa636bcf61644
SHA1ed241e8f2f5ddc142de555df4225290b18679800
SHA2567a2ed56fe14ec45c3deff59754ed9e3b8d8cd6d41f1b717467ac9c55986c2f27
SHA51225acf50495262827fab655f3d7e0e0e15ca632a639ad964874663559a6075f53be85bf833f4cf51e908ce97de8eee32c1156b652983519d4ddb5f66c6c533799
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5bc0d32d5f64fc7ea7497aa6e78fe0a14
SHA1996247c187dfe291e251aee140438af79b4bb55d
SHA25652aab5be1b15a9b59fdf6b9e3e73dc21bb571b671f49d28820b86b91f15efaec
SHA51229310b915480cfa35275e0508f763a50d0ec3a924bb1f9cd3ea8daca732d4530854e447bda5fc151178c2acecbbb893ae794df41a874c473987259ef9858b3a6
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5d165b0a220f2400fad366057b2fa4972
SHA17e6f6518828527a0633cca09fcaf8e5a0e9d9692
SHA25622e268dd45cfd831b153bd52872fb3ea88df25cc32d18d662b6ad4204a6b4a75
SHA512c073e6131000095e895388802867aedbfb0c81d058e4e850ef12e16ed37e2335c33d9107219d83c1a0177c1d3d3dea43e7c0b14f9fc39aee92cd1d5b02206402
-
Filesize
108KB
MD5658f0ce5e244714c71d9ae2f2ae735f9
SHA16386f76dd579290447bf6cfe06d68dc7cf539439
SHA256b36f9deec710a7ffd99106ef0fbedb41aa05276985bba5c2928a6762d0039263
SHA512ccaedcda57e67105578f73924e0f35cc094cb6ef6bb678a4eb57fb65c8ce8a0610bacb08d60430b324f682db7ae0a51d84b5b187c61b4bafd349a445458fc51d
-
Filesize
173KB
MD5cd8f072b3f40bf27a466516317be3e9c
SHA16c0a4132993de5a49a589c947a19f4f04f16f307
SHA256156fd5df9778b61cfa6d617a769f081cbb7c34bb8b58e53868561566f5e408d1
SHA51289e55a04541ecdb6f41261c27aef83973f9adeb6d87c8175394c45c27c5b73293fcab3797fc7c1e03bfbdbe19a7e6e8c7439a06190980c440cedbce839208d48