Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
13-09-2024 22:04
General
-
Target
79d46ac69e6a95b0e4445b3a09644e1574a2800084c89435bdc89065b368f57c.apk
-
Size
3.4MB
-
MD5
e8c985fabf0689aefe464b60594138bd
-
SHA1
7c18ff0b45041e39591d8dcb8a860bc590ef3fbe
-
SHA256
79d46ac69e6a95b0e4445b3a09644e1574a2800084c89435bdc89065b368f57c
-
SHA512
c9138cf8fcd564708ca42cec97faf4f34f996b81fafc739b7412678c82df44e24a015adb8d3b0a1a36fe020360ac4320a00801e4b0906797314d56ab3816919c
-
SSDEEP
98304:/DwHSSoCJiJRwoW3EMSJITgFciNlc8fiZXH:/cHS0iEbSJugyiLJqZ3
Malware Config
Extracted
hook
https://ws.jomylasochi.shop
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Reads the content of the call log. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d6b5718dd517169532b668857808830d
SHA1bc7fa47dc4a93d6970f5c3ff6a7676fb5d053131
SHA25691921a0209938db78674c57c2b3566b614ed36d71ce0a6426ea5fc54d0ed1bc5
SHA512c178e6dbf314e05c42fd5c77657a48acf010d40cbb927cd56ffbf140309d13a3a67c303dcaad967e41891c4ca6de55e3f06c31a5e2e2d7dbb6c4dfe735a621ab
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5d0508707c60349b2aafa28bef94a7adc
SHA1e612ca123f7b1727ae4b628e516264c7cb38f30c
SHA256413beee3844497bbee2321b3f5db200af11f06cd538024bb999c64ec691899e1
SHA512d1eafeb31d55e6585f87eefc246f9ced6f7f97d50ff28c49ba6be0952b27b1c2a9abcd40d429aab93afd48620efe7ac4710170f33cefcdfc7c7255245b66d151
-
Filesize
108KB
MD5e16a85b8f82749ff06881057b07d9771
SHA17f7e77c1dad2bca7d90b69163244e3fbd70a575b
SHA256dcb0cdf0d72e299005cbb97c9d817f8b82f470042b6d76982e4a6a5200b52892
SHA51208408c8efe4680f821d17415285faa2ed451826d04820f0e57b968669895759fbca60a0843ec4d81054a4bc25c73089c35d0b85efa6d4da3631c2dc7367f5e12
-
Filesize
173KB
MD5b028a796068475f5582e553f12d3c841
SHA1f48e43c949a09f2632e05fabe228d776c09d5665
SHA256dcdfe8168120af3488138a2d96376696439c54f8a865f5c9f9a81b513e950712
SHA5124d80cc1f681faf12f2255cc6ab01910b1c435a906e267a2e8abaa4afa72db95f9ed1a4bce6b75acc18659d8371c7b085879b5c1d7971412133b81ca92da5c6ca