Extracted

• • Target

    337756abc3fa02dfe09bc0e5e1b1d79e044df39d43ab83610ceba38d313ed821.bin

  • Size

    2.7MB

  • MD5

    6ff4f3fa1d7f7bc9bfe57a5398cc1f3d

  • SHA1

    23167df1f7acdd50c75683320d2902f1c248e2c6

  • SHA256

    337756abc3fa02dfe09bc0e5e1b1d79e044df39d43ab83610ceba38d313ed821

  • SHA512

    77fb0ba1aa52da15741b03aed9f7a01039de2cb2cc441637640677ca9d9b33e4ebe52be8cc60e1599b977ee0a4505fc7cc39bb6fbb645c89a4de09cb2b41b6ea

  • SSDEEP

    49152:JBrHKdqNDcZJEH8SpZqqqvDzPPifbH5nj/0XFfC0DFnvAfPZy54gzJPx:HqscJEH8SpZqqqHsJjc1fBnOo54MJ

  Score

  1^/10
  behavioral1behavioral2behavioral3

• • Target

    childapp.apk

  • Size

    1.9MB

  • MD5

    13d75db1eb7ed700e84fabbb8b9f6550

  • SHA1

    edd021c7020c07140cea7352ffad6837f052f54e

  • SHA256

    fed9d6c0afeff04097c2199c37e6813f6b3cfb3f02a43e5dc40c62db70f009ee

  • SHA512

    4116e2d1d910f7653e991fe11312e23cab997ae5b695efd7d02ba4d3c1441a8408afe647f508f842baa0208694cf93d63eb5ee4fd09586b28df49ac1c038ee4b

  • SSDEEP

    24576:mw36hfeHJyQsh1WuVx6Rq2NxdrmF+wOjys1g/Gj4:Jq1ziNxd2Rs1g/p

  Score

  10^/10

  hookcollectioncredential_accessdiscoveryevasionexecutioninfostealerpersistenceratstealthtrojan

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Requests enabling of the accessibility settings.

  behavioral4behavioral5behavioral6