Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system -
submitted
02-10-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be.apk
-
Size
3.4MB
-
MD5
dd5ddf91605528aca5930f79ee64b486
-
SHA1
1ac4ec74d9a908e9bc3fef8cb88c0bd3bb9f395a
-
SHA256
6baf0211c7aae5041fc5553ee7e0a1ed496dec535999ec0486261cf1a9fb02be
-
SHA512
7cd9c7ad21c985ab0c78fe6d64b962c79374e2d188dfdfaf227b4df0f6ac104d12373e8f251101b178f6f8c4aa4a285d711129575a17b109ecc1894f6a4a28c8
-
SSDEEP
98304:3XZy9kcal9V3sQysfppLLOamr5gp6QrY2KEGbKl9h:nZyO39F3HOadxrhLxl9h
Malware Config
Extracted
hook
http://89.248.201.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.chxdsjsbz.dnykbpzhsioc pid process /data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex 5167 com.chxdsjsbz.dnykbpzhs /data/user/0/com.chxdsjsbz.dnykbpzhs/app_dex/classes.dex 5167 com.chxdsjsbz.dnykbpzhs -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.chxdsjsbz.dnykbpzhs Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.chxdsjsbz.dnykbpzhs Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.chxdsjsbz.dnykbpzhs -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.chxdsjsbz.dnykbpzhs -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.chxdsjsbz.dnykbpzhs -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.chxdsjsbz.dnykbpzhs -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.chxdsjsbz.dnykbpzhs -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.chxdsjsbz.dnykbpzhsioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.chxdsjsbz.dnykbpzhs -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.chxdsjsbz.dnykbpzhs -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.chxdsjsbz.dnykbpzhs -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.chxdsjsbz.dnykbpzhs -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.chxdsjsbz.dnykbpzhs -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.chxdsjsbz.dnykbpzhs -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process File opened for read /proc/cpuinfo com.chxdsjsbz.dnykbpzhs -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.chxdsjsbz.dnykbpzhsdescription ioc process File opened for read /proc/meminfo com.chxdsjsbz.dnykbpzhs
Processes
-
com.chxdsjsbz.dnykbpzhs1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5167
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5623eb693bafd551433486df0ceb0429a
SHA1d0e7090b942db9f6a2a54fd905e5d14d955624fb
SHA2561c703e82ecc1e84afd950f6ff9b5cfe25a5971010a79ab1a75911eba06ee111e
SHA51224376884977ba64dcc9a72ca4b70888e740a06a720fadbf11afcce5c85ce1876775f57abbf56be80fb24476b61c4a318511d1d29bcc45e6e52a70dc59e55b262
-
Filesize
1.0MB
MD583d0bccc9a25538f24011655b434ab6f
SHA1dbb4d103cb3e58dee14ac0d3ec80b34d433f8624
SHA256a2bca56dc5cacee1a3dd2fbd65c73416960d0ab5a36af4861c92bddc416d1e31
SHA512ef27bbfe333d734a33ba54738f0219371cc13f22732badf2cb0490c1851439cf52ff9d91fdeef55e66b03a35052f296aaa210f3cc5ff94ac90c145951cd2a395
-
Filesize
1.0MB
MD5f17392ce10d688cdd977fa9f357ef0b6
SHA1a56821309448ccf764fe9f0f529b54817a9a1795
SHA256fa85100c43a032bff196627bdfe439ae0fe82375ffd55a33990f5fd913b6d800
SHA512f7fd3a800d5a60f4b4e9c1e3fec33d5ee16cd8833c014c8ec3570a535064e6160e88c809a599d4bd7f081b7be3c4a9737aafcb8b86e8b374903d496fcf46ee0b
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c92073ac76b1c77276b47c151c4c3145
SHA1970dfb5154ec988abd11a36f9f4c07b2040cd289
SHA256e5fcfeb4ddfe0bdff5991280aee7ac67e99fa5765ffe4033daa5c8c8a5430532
SHA51202f3b655e9cef860fb1e9f44ce1ac85cc42aeab712165b0f395b8f9cb05efc83fe635692ab4f411a564fa46d92fdd9748d4725707897306a2d22519513e936a0
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD579d6ebfb37c3cc699fd21dbaffdf6391
SHA1a23d8cdcbe61ab3cc6a5e4471f905bb954aa9616
SHA256cf297193c10944ce41f65f0e5eeb83ecd4e345203a755e945b6efed297d002d9
SHA512972b23c85734866346108195df6bdac62f35bb539069b0d1ef932e7532c69c0a8afbb1679ab1fa777bc074a3b1bca34d2827fdf69010d29697dde68cd4fa7796
-
Filesize
108KB
MD551405a9d06130131b520ceeb0a802719
SHA17156fc2eb380a8f97f3ae1979347bd7e330230bf
SHA25688590d6d6aee146d587ce3c4ef880e6d0d2c8eb116009156ee19715c9a260a3b
SHA5124b85bf3c57df26e0f387dc8d085ebb4c779f8ac238137d25123dbe8f088206342eea228788fa244fdc185eb0f0865e118c3ab286b0aee6ac8542b6cd2ecfcfac
-
Filesize
173KB
MD5d4e069b3d1fa45a3e94604cf24f7f502
SHA1b846d5e456398953e185dfbd0595fa810f821d0a
SHA256dcbd7390108a37f8c49f0002ca35516f09c1366a09e316ee2ba9a15424a3a2ae
SHA5126f17fe1a17b4b3d3d5529d27466c909c28b6c5a10db0f11530dea9246cb0ca202da55cb2d4657f8890226ae515d0fac5dac000621e7cb8c12314205454108fda