Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
02-10-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
-
Size
3.4MB
-
MD5
dd5ddf91605528aca5930f79ee64b486
-
SHA1
1ac4ec74d9a908e9bc3fef8cb88c0bd3bb9f395a
-
SHA256
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be
-
SHA512
7cd9c7ad21c985ab0c78fe6d64b962c79374e2d188dfdfaf227b4df0f6ac104d12373e8f251101b178f6f8c4aa4a285d711129575a17b109ecc1894f6a4a28c8
-
SSDEEP
98304:3XZy9kcal9V3sQysfppLLOamr5gp6QrY2KEGbKl9h:nZyO39F3HOadxrhLxl9h
Malware Config
Extracted
hook
http://89.248.201.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.chxdsjsbz.dnykbpzhs/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex 4330 com.chxdsjsbz.dnykbpzhs /data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex 4356 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex 4330 com.chxdsjsbz.dnykbpzhs -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.chxdsjsbz.dnykbpzhs Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.chxdsjsbz.dnykbpzhs Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.chxdsjsbz.dnykbpzhs -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.chxdsjsbz.dnykbpzhs -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.chxdsjsbz.dnykbpzhs -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.chxdsjsbz.dnykbpzhs -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.chxdsjsbz.dnykbpzhsioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.chxdsjsbz.dnykbpzhs -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.chxdsjsbz.dnykbpzhs -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.chxdsjsbz.dnykbpzhs -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.chxdsjsbz.dnykbpzhs -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.chxdsjsbz.dnykbpzhs -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.chxdsjsbz.dnykbpzhs -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process File opened for read /proc/cpuinfo com.chxdsjsbz.dnykbpzhs -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process File opened for read /proc/meminfo com.chxdsjsbz.dnykbpzhs
Processes
-
com.chxdsjsbz.dnykbpzhs1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4330 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4356
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5623eb693bafd551433486df0ceb0429a
SHA1d0e7090b942db9f6a2a54fd905e5d14d955624fb
SHA2561c703e82ecc1e84afd950f6ff9b5cfe25a5971010a79ab1a75911eba06ee111e
SHA51224376884977ba64dcc9a72ca4b70888e740a06a720fadbf11afcce5c85ce1876775f57abbf56be80fb24476b61c4a318511d1d29bcc45e6e52a70dc59e55b262
-
Filesize
1.0MB
MD583d0bccc9a25538f24011655b434ab6f
SHA1dbb4d103cb3e58dee14ac0d3ec80b34d433f8624
SHA256a2bca56dc5cacee1a3dd2fbd65c73416960d0ab5a36af4861c92bddc416d1e31
SHA512ef27bbfe333d734a33ba54738f0219371cc13f22732badf2cb0490c1851439cf52ff9d91fdeef55e66b03a35052f296aaa210f3cc5ff94ac90c145951cd2a395
-
Filesize
1.0MB
MD5f17392ce10d688cdd977fa9f357ef0b6
SHA1a56821309448ccf764fe9f0f529b54817a9a1795
SHA256fa85100c43a032bff196627bdfe439ae0fe82375ffd55a33990f5fd913b6d800
SHA512f7fd3a800d5a60f4b4e9c1e3fec33d5ee16cd8833c014c8ec3570a535064e6160e88c809a599d4bd7f081b7be3c4a9737aafcb8b86e8b374903d496fcf46ee0b
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD544bc3f3d614f56d13efce4c230915aa1
SHA1a7d30ebd7afb6e36ae3c49efce547292de924fca
SHA256740c4af293d52e36709a4b2f146cdb8b2e9fcafedd195b2cc74b6ec7619d52dc
SHA512cb1e55ba547c61990e2ab992394e24f8f801cc6ee9f5c8be09b2d831fb20005e627c54e48b7ba594465104255011fe3d5bc759723c077d840c0381c224200790
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD59caed767887a1392fedec2ea6db1f4ff
SHA1c69ca36ea89ea024a87d84fa3b3483630cfa92c4
SHA256842d43ebd5f303982b3c973e6929edfb1303357610efee227f9da72aa637c2a6
SHA51205151e81db038007052907904cb0b88c74b2c3c036efb9b8fa86d40ec0a48c8680c7a386ee04ea995d1dfbcb427e916110632c9cc7a1ab1c561e6024df29137c
-
Filesize
173KB
MD50c6b2697f261935049e46592fce2f40b
SHA1e37792120978f457d868af987caff5fae13d68fb
SHA256479c7d41f230ea8817bac92ec4c8a2adbed2d541483ae7b070d3f1ee754cdc6d
SHA512e3c429c9f12e240128d04d6ab598b45c767f9cb2fe9597c058377d600dae7e5584beb083cffb3a4d94837281ab935092c8419362f9bd3b56243756b17b52c449
-
Filesize
16KB
MD539062f255ac1c10555ba1fe922cce8e0
SHA177154a1e8fc4a7dbfb91e0e9ac81370fd30810ac
SHA256c5854ed59c032bea8e904a2762a15160e1b463a85f80a5d8f9e4e7356f6bd75e
SHA512f0e8ba89a8ffb5cd6ad9932f65c97a37bdcf7ef847adbeb817c16fd8eb5e7b4d9d5f1382c8df52ec511bab2fa56bd5409e36cd72bfc9a66df0ee763a0c6f070a
-
Filesize
2.9MB
MD5b0b9c8dc440cb2f472132c6512651b85
SHA1f0059a26522dde3660040ce0944912e75ad1182e
SHA256610a49a6828231e1618349ac7c4445b4779434b4e55e301915a285d20b5614a1
SHA512fe7226011e61ca9af7e05026c82ae700daf55791576bb4f93db5d5719711f30f336a7f884bb071fd1ec59d277c756fa663d9ee6a36428b00fe04f53653f13522