Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
19-09-2024 22:11
General
-
Target
598bc60766257dae5d3d4084cc5d6b7a00ed4c4bd30cd5fff917c5ff302eb176.apk
-
Size
4.6MB
-
MD5
2b149bc3df94688825d12afb298daff8
-
SHA1
4cbe9a66e0c7a4a334008920e85013d409b00ba3
-
SHA256
598bc60766257dae5d3d4084cc5d6b7a00ed4c4bd30cd5fff917c5ff302eb176
-
SHA512
50b07ba4e7274799829021907888a553418b3ae291730f0bb64ead94983b868e9810f9c1aafe242725cf9cfeccab32b61b147e72850dd2ee6476486a2106857d
-
SSDEEP
98304:C54jWWe9FkPBHh3U5sGLRhwZtCq5lZFyc2zkyjIQj+jqWFshL:C54WxOPBHBU5sfZ5sLkyj1j+/FeL
Malware Config
Extracted
hook
http://92.255.85.109
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 17 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cikwnopoo.eqefirxad1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5a69b764058b9af461a49a105667aef5a
SHA121d9c98f6c59c998359422d537e95a8e72d65933
SHA256fa10f300829c3e5da6306172c971f99257748041b6b268a19c8b34924d895a0c
SHA512a67d5984779ae89313fbe1c9bf1ebbce7e3c0e4270efc58906f5ce15fab7deee01341d9161b0cc04198954bc24d2cc540c25c6e3dc9b840d1c6c79f03a5f221d
-
Filesize
1.0MB
MD51d10f1cb4b418c1ca3c3490d446ba91a
SHA16a42d47d9d28bb5fc10f645aba960513ee68e614
SHA256cf7c3a484d9bf179c9e6991954589035041f7ce196c3f27413fc171cc1066967
SHA512e5eb4bf00651dc209688ed035a4e007feaf60c2119afb09ddd0abcd0c6d446ec65e41a5995e985b70cb63068e84ec124478a3c11e5d0061d2a4f19ba4a0d337b
-
Filesize
1.0MB
MD5cd0e8976207dff46abe97e5a939ec21b
SHA1ba566cc9e02b1d283775d6c061f16487fa2edef6
SHA2568e0b51bac2d538d693df2593a242d2b292ce30339bb1f1640dad7ecca554ec03
SHA5126803e5674a38f06f8d7c407aa4ff1a6e069b913f5a95cd642eee635bea56ef1bf0ce620d302604e757dc5e6aca741d7cac34c7cb60ed141ffa2b5422b8e9fe6f
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD544543dd7ce08813fdab3d29ce985f32b
SHA1da89302513f67beeed6cfc499a5b1acf26b68311
SHA25664806fb9f3606d80c2e6f1b66d897989ebeec8d7e2ff1570ca641b1d5f075ee3
SHA51279530a08d15325ce3c1e161ba4a3f773a737aa4351738ef3baa7b57308e09a1af2ab93a0249eb86d36fb7186387c98e6e10524b8a419ebf34fbd28c9407ddc3b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD51fe3602a63b925b509447b1fa303babe
SHA1b8b07028f1605130bc561e62c61c9e49ce69fb97
SHA256d2f39c62b8ef416578dfea1729b382136623f4a7917e8125b0ce1ce9f692786d
SHA5125736577d39d399c68dcddde38664ea439f8cfc4bc79d83db2038d5edcc9776d2cb6d2b7160505d9a77889b77ed6bdb7340d2ee6b7a7b5e4b654cd2df9853346d
-
Filesize
108KB
MD51a8aabe4485ff3cd13ff1c8c1ee469d2
SHA139ae8f7a83831b9d9e1eca479ed49bcf500cc924
SHA2568e1539f4cbb663075cfda5bca9d3dd31a38fc00fdd486b47fdd36b1ef798fe6a
SHA5126dd521c036832ae8807e31f6094275aac969dbb1a5c41b3ea82deb5b1846d1eb1693dc0ced0bbc85f4b18e61de7d8cb003c1d03f93bbaa10710323cdfb2f6d55
-
Filesize
173KB
MD51f5102c5e3b07beb880ea3627d88a294
SHA1b7ae02b75050c2f828d691be964e4514d3bd9dc7
SHA256c17918f231d295d1c90c73af36ad6c98e8c16372a31859bd0beef316fc97aad8
SHA5126b27d76f252cfc09db040b9b8a447e1fa5baa48571fe4da0e932755e68b9d4a154ffc08a316d4ec3a9fcd2cefba95f60591652810c1216bef3acceda4ceeb11d