Analysis
-
max time kernel
148s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
17-09-2024 22:06
General
-
Target
63bb2b83b428173b5fae1f9045d6f292fc78346f06e83c0228f402b859c99cd0.apk
-
Size
1.2MB
-
MD5
069b70368412145004eb06062e2460ba
-
SHA1
462bbcbce004e03218acd7d1b0af4cd7307f4d54
-
SHA256
63bb2b83b428173b5fae1f9045d6f292fc78346f06e83c0228f402b859c99cd0
-
SHA512
e5910e68074cd0fa7eaa2d5e86c75121b40a9bdc6efe5798375e1a06d2770e51a3c6def38f8e9022aed9ac64e5a0ed1a7b1049af5dd4cb5d2f8f77ca48deeb5b
-
SSDEEP
24576:hDgSF7tqAvcY/a4jCYS7kYJr+AXZ3yb5BaZErCvIB/owkNP:hDgS9tnjC5r+6Z3yb5UZpwFVQ
Malware Config
Extracted
hook
http://92.255.85.109
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dehodigipuhixoyi.mafuko1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD57d6ff9a8cf7a9d7c6b47590d120feaf8
SHA1fe152b5c6739e303a57ed71968a18c8b435a3481
SHA2561a932f729997bac4252ecf0c3ee439a30dfe4615ceabdf9373052a0ca1465aa4
SHA512b3df1065b207aa61d7fa0d2b7528f769d94c955ba416c21e75f6fa3861d333e4173f1857e5b2d97200f7c28c18b25631b2e74cef37323ebbfabcf493f0fca665
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c8e240a6b365c95eb2872c7e873f5d96
SHA1ad2cfad8da4da44c22151fa922f7c885241d6366
SHA2562a06dab8435f8e00528af63ea1f01a883079acf0859172679a5f567478ae45ed
SHA5129e7118f07f9d952fff048bc8cd3d4d412aa62d0f94431c1382015b83b333bc9b0c9c21aa10dfaba792c6b5e90ebe0c2411bd0ec1da3fc50bf7e5a28edd9ff7b5
-
Filesize
108KB
MD5a1bb1e00e135b26405d66a8d45df4b85
SHA185f56d044acd0653e30e03bab56dd6f38a718590
SHA256f3013c1b5b8fbb8609c6b3ec4d40559ecf2c901b5af0ed46d74482de1a840abf
SHA512a0ae13cb8b844cd1ec161c139d6f03473f365e38c321f7d81de23565cbf831c4ce2e94065bff5aa17a4d193943a7a3307ecb460fd2c566b9ea341c84260d0815
-
Filesize
173KB
MD55fcc28b6a9d8957b16c8bce83f1033f8
SHA1902f4f64e30fcf43aa8c892bdd0cbfbaef74a487
SHA25662b859ef200763e047c672e6e27c3347fb3ad7afa523e708024f395358efc0c1
SHA51212b6b5cf39d2befb6b85baba09896ab13daf515da5e56b9c7e8ea685b8a62f4f2c5d9490eb45459394bac7e9e65e44d85a870162bbbdf22fb0098d26ac3f64d7