Analysis
-
max time kernel
46s -
max time network
157s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
17-09-2024 22:00
General
-
Target
beb0830b962682a2dc04ad50bc47026068a79908c86326bec5edb2e298b1ecd6.apk
-
Size
3.8MB
-
MD5
401140e4cbfea9e83e21ff0b3210d9e2
-
SHA1
30bfa63bab65efa6d2c42aa6d8579551d2d4ddf2
-
SHA256
beb0830b962682a2dc04ad50bc47026068a79908c86326bec5edb2e298b1ecd6
-
SHA512
384557fdbfc093183ce3b831aab3004ad3dd3c6c74601b35c976a53457d20b2e18e1d2eace7bb9bdaf8210c1caef9f01f77084af002b834f79db0cc89ba35683
-
SSDEEP
98304:Y5Pi6dx6d6NoCJiJ5gGK9c7/PiqwDPIAWuyRlc8fiZXk:YFdQd6zipWOigACJqZU
Malware Config
Extracted
hook
https://ws.meangirldforvep.online
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Reads the content of the call log. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Reads the content of the call log.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a1bc3440342745c3d7adb84caa41e181
SHA1bf2fd1648956407d94e0a2b2951b56afa1351d2d
SHA2564de2b0cd62e7781ce006eb0443ef4516b2a7eb6786c20d70f913b3574bd96529
SHA5123f6bc4ae70d1b65064934978b4505253a2b0adaeb4e39acb04bf8bb96794224be99bfdb68c2e240329b9d8b1a86e42919e2c9f3fff38e1a4db323975ca30ff2c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5f97981f5657fd5fbee3b6b7189be0502
SHA1ac7a8cc77e2a16893b1fd3246529232215b476d2
SHA25637ef9dbe33283064076f7f5018637b53b68935e4ce1f57edbdd60268f695db8b
SHA512212c7fbafe003e172e8a6e17efd3d5326aebbec3a682412ba9fba79549906fc8a4bbe9c1f40e526399469ce37dcfe339aa2c5ccf6e5f88ca772f354c694c2496
-
Filesize
108KB
MD591171dc42c5ee7ada55f0173575df58a
SHA10bdf5ce625a3a98c0fc85eeface1d23e2b1b162c
SHA2560e5bd0796f99d8f0fdc3764f910b1ec4fd2cbd241f856a200f9e3aa858c3137f
SHA512b29db9233583d67f8ee05a4eeb8f43cb35c6578f0012c1ee2a5d9acc41b44d0981e203f73eb97ed0552f8ee1bb569f3b1c0d1bad18f6b420a0aae0827f9dfef3
-
Filesize
173KB
MD5c1f25880859e9884a8320c12c7e26f73
SHA1908cc7ffbc91e66f2a326e715d9ffabbb108fa9b
SHA256b0dd7ce31ba411457584b835859e29b2fa44893781907c884e049ba70189f41e
SHA51203fe1bafc7df75cc349cb70c11c33bf0d0f9a5c3ccc1ae04d308dbd30fc398f08622f3ff51b405f96d97b3c5f69270faee4c1805fa81b51133582232de37ec31