Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
14-09-2024 22:03
General
-
Target
0e8c9d3ab7c5b39f1aa8e639333238a93c7ac627a94acc3472386c10d0c1d760.apk
-
Size
4.5MB
-
MD5
01a3606e2217f1dad0e9de4b2c202397
-
SHA1
b336582cf54dcd5ec3b0efb1b11e164bf672f78c
-
SHA256
0e8c9d3ab7c5b39f1aa8e639333238a93c7ac627a94acc3472386c10d0c1d760
-
SHA512
d12bf246bd943b2e85adbe3f8c306f562d7d8f06f9d4da239f9499ab2a596ab768886d22237c01b5b2f6c110f5934e581e7c2d0c65ec42df1b66064dcd81eafa
-
SSDEEP
98304:WqMd6HDKhiA7xVUGo0u+nremJBXurC9LS0KvGW36d:BMdeDPwjU+VSmJbL1RW0
Malware Config
Extracted
hook
http://80.64.30.123
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 17 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ggkabyurx.cljrtrclx1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5b417b641fe4cf7480812586558788390
SHA1379bca2d3b614017ec94e4d3d35e0e8ccd9cf889
SHA256e570f75e4e7e78be2bee5c5c273511f08f5071537e027d26191d199ddefc3948
SHA51210655cca4cb46c881580e1f2848add176565b9bd4d1a91df811b21601d5627ce904b4bca9ad67679db847821587ed44d5ecf61b5c8aa418c0f2ebea0f53d432f
-
Filesize
1.0MB
MD5265c2a5b83b196bcac144a4b7d1074a4
SHA1fa7e63327a8fca13ef4302bb78e7108b79787541
SHA2567fb7b19401feb963ed29aa13117f0a1ea6a428f1febdf7453bb7365a0749dcec
SHA512d51621e08be8cdeeec60d189f36b9d0d8b33909236f099dbec73f99832261e553c1f483702f0dda79a084e73ccb3b9ecd215551aaa40a6b7c7fbf3728d679de5
-
Filesize
1.0MB
MD51d74ea41adbd7dd8a3932e50ddbe5f27
SHA135c719636b3f9134119a09843d451b8d9b484913
SHA256f98f69acf1c80f1502714fe17ef7b1ca60d84b6fe58c8e6a76dc9d71740ffe38
SHA512b0e3d6344c4657e16e91129bfa704c1327a5282cf04024fc1d164f96252fdf858a6291a853d0db70edac1ccddf26521c2f26e73046472d24361746669ec8ba59
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD50150b4ed07238f47acfa94248e16ec67
SHA17bec7243af412631cfe584657dd83e7c2238cfed
SHA2566f56954c11aa67c1723f3893254df5455d02e61bd2e549a0fc46c6ee4eddaf48
SHA512054c98aaabb6c989db47d5c1636ae24c301a0aeae4ee12576914fa59b44b41ef0d4f81172a6774d80343d60f740d02971f43b9951b3ac9eb60ebe8209038bce9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5817cae6a9382e08d4b685ab2ff6afa7b
SHA10f9407e2e29683c8adbdf8ebe019a756af339623
SHA2561686dbef8985a29d1c91bf937db2f36c1b632982179ed1018d8e2ffb060592f8
SHA512ddef4c8ada7f16c98f8bcff8285aa3290a13d233fcacafed80553a8df7232600eaf2891bffedf9e31d81bbc839e112c5065db8d1f4feb9d159b50a4d253891d0
-
Filesize
108KB
MD591edbd6abe3bf685fa4c9b05b87c60eb
SHA14992ddd24fa56c92162e5c2b7c6bd6ba529f2a91
SHA25665ce397d9121ab03ee75301c7964c32def0589e27fa0edeb38940142f3298102
SHA512fee0e55026eb8b0debd69eb9c82775937c6d51b2712ffbb2bd7f30cc64b40ba2b939a7914060c21e0b89e9b218c8d97dc94cc755afc1a102318690578b6c8c93
-
Filesize
173KB
MD5f0860493e68bb5d0848363c39381377d
SHA14c45feaf183e89dcd6f7e5ec8a0cb135a87bdae0
SHA2562ce372a9f0b3e871344aa89a66b6cf9bae2c138a5aa2cd6a06b8d34b8f379f27
SHA5121d5575a0618895fbad4cd869e713cce455b986602c0a35ed73c6c53e7efb6ada78cd11cfeee18f8262b4cc614eece331725b6a034f5eab2bee788dbf1d2b2e16