Analysis
-
max time kernel
149s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
18-09-2024 22:07
General
-
Target
579c5c1126aa330e5e8eee1461799d84ff1acf7ba7a593c933120523c72e536f.apk
-
Size
1.2MB
-
MD5
5b7903126a21275d7bc748073188b232
-
SHA1
b13186d9e448e6ae415d0d4bd50e35a55936bd09
-
SHA256
579c5c1126aa330e5e8eee1461799d84ff1acf7ba7a593c933120523c72e536f
-
SHA512
d3a0bdafe42233d10bf58303f1846f94101430d10578f75ade013e106d3f4712ce91aebd862c4a3c7219bb8c06288828355d10080fe19bef364464a2a7d375f3
-
SSDEEP
24576:PDgS5V9wA3Ufx86cRqEikqVuaGaWu5aMu/T:PDgSP9GcRqEikqVuLPu5u/T
Malware Config
Extracted
hook
http://185.147.124.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dehodigipuhixoyi.mafuko1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a110ce9c04dd2605b5b00bb41590b9e1
SHA106969065ffd3c0d88ce17644d7ac573d1b0b016d
SHA2563ffe1e54f42758d1531dcdb0144cb0602310d249b9fcfcfc81362719825e3967
SHA51270cbd69d088ceff268af94d68d67278a988d2a2bd0c32ef162b0b22d1363733ed89f8d5b6a75bdfb62d982dbfa7ef31933863d9e1c87bb2ec52582a28105b783
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD597fb18aaf8e8592feeeb2c0b082b9ed6
SHA15aaac1fec9f8ae27dc4148ce5eb952e633b630d7
SHA2561572a4eef5d3957b9d226fe59496f76899c4066ffe47935a29b44a23f93a9372
SHA51236523b8747d86a7879f1547ea7a76c7016bb6ddee1536872f8058c020c85ae8269c007cb6d3e2d51342115bccee164fffd641f381de908b3e005042d08288509
-
Filesize
108KB
MD56d7b15403cd6833fa4536635076dedcb
SHA1f696ac789b8dd0da7bf764fdb11dc9981c7f3b06
SHA25660f534e03a0736dd4cd50f89a7e22a691dc43cb42a9107427919c229649bc818
SHA512f4b4f4b936b0f0a86640edcf970ce7c5aa3e8d985f07363f03501cdf1ebcc0ea882104a07302eb3f61e0dcc5345e5441daee0bdf628d52c95e8e55523c79b424
-
Filesize
173KB
MD53e506a9f594e46d3060c97254c1dcda2
SHA1278df12cb8191b5a3cc7aa9650f98b481b988bb9
SHA256987435d781c6256a069bc43c49722d2cd2a312c4de9269d16269509e8cd2c29e
SHA512c2036a8bbdee3f02bd09b0885401cc6c6ffd46ac36654cf711554b7578816ecae9bc46b873c6497551d774d6dfe353081660ad7f26ce024524aa216fd744297d