Analysis
-
max time kernel
147s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
03-10-2024 22:22
Static task
static1
Behavioral task
behavioral1
Sample
d6055a1fb1c8eb61f823411559876ee36cf3f018550fe5a383bf023ed2cd0876.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
d6055a1fb1c8eb61f823411559876ee36cf3f018550fe5a383bf023ed2cd0876.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
d6055a1fb1c8eb61f823411559876ee36cf3f018550fe5a383bf023ed2cd0876.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
d6055a1fb1c8eb61f823411559876ee36cf3f018550fe5a383bf023ed2cd0876.apk
-
Size
4.6MB
-
MD5
03716426e2899754ecc5f2c463d78a85
-
SHA1
0c72c0e4225d0c80d82f2f9053e2acdcdf4b2e8b
-
SHA256
d6055a1fb1c8eb61f823411559876ee36cf3f018550fe5a383bf023ed2cd0876
-
SHA512
c59ebcf06d9a2e739adae3145572b2a8ccaeb1a7ba608219d0949f0d45c57514fbf158c1513ef437c1ea5705a51ab6c8b714d0b2a71cd4594b3782a6752721a6
-
SSDEEP
98304:yNEgpEnpZaQAvdd280S9zM+BPpcXlmITMkqc4M79pjD1Z/Vj7/:yNEgpCZaQAvYS9FVpcNY+fjD1Z/Vv/
Malware Config
Extracted
hook
http://maisrosoft.com; http://nkjhgfjhsdhjfk.com; http://hjfgghjdfhgfdhgfd.net; http://kjhgfdrkjgkjgkjg.org; http://sdbgfguhcfwyutdityer.net
http://maisrosoft.com
http://nkjhgfjhsdhjfk.com
http://hjfgghjdfhgfdhgfd.net
http://kjhgfdrkjgkjgkjg.org
http://sdbgfguhcfwyutdityer.net
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.cicmiduox.oqgbofrks/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cicmiduox.oqgbofrks/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cicmiduox.oqgbofrks/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.cicmiduox.oqgbofrks/app_dex/classes.dex 4260 com.cicmiduox.oqgbofrks /data/user/0/com.cicmiduox.oqgbofrks/app_dex/classes.dex 4286 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cicmiduox.oqgbofrks/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cicmiduox.oqgbofrks/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.cicmiduox.oqgbofrks/app_dex/classes.dex 4260 com.cicmiduox.oqgbofrks -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.cicmiduox.oqgbofrks Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.cicmiduox.oqgbofrks Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.cicmiduox.oqgbofrks -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.cicmiduox.oqgbofrks -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 6 api.ipify.org -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.cicmiduox.oqgbofrks -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.cicmiduox.oqgbofrksioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.cicmiduox.oqgbofrks -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cicmiduox.oqgbofrks -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.cicmiduox.oqgbofrks -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.cicmiduox.oqgbofrks -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.cicmiduox.oqgbofrks -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.cicmiduox.oqgbofrks -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process File opened for read /proc/cpuinfo com.cicmiduox.oqgbofrks -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.cicmiduox.oqgbofrksdescription ioc process File opened for read /proc/meminfo com.cicmiduox.oqgbofrks
Processes
-
com.cicmiduox.oqgbofrks1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4260 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cicmiduox.oqgbofrks/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cicmiduox.oqgbofrks/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4286
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5f54fa4f82bb979ab90223d528a6807ca
SHA14cbdb0a24bb1d17a7997ee1616bd1011f6f01118
SHA256fae014b6d416ef8a86968380ccebb8974ef3bce4ae14a5b54d825edad9751731
SHA512766323e9b69a30d4599be80a48986f55ac2e3946ede3d2e4dbca2f6956034a8bf6bed8f52345f6f011998c72d882a17d31941c98eec1cf86d6c995b0af5d451b
-
Filesize
1013KB
MD5494ffd9be243e9587e1f9d613d25882f
SHA1aa7f479dad887a6e751bd749536366280a0d59cd
SHA256086e0541e083e685d3fcdbcacf4fc610747994366617f2d691ab37ad59d7f486
SHA512b7dc2f846bcde8b9a103f14c7bf8e642c5f42cd496308bbd127c698e77862077dcfb2e4913cee60955912f14d44337cceba10ce6c4b70135ae13b2c7755bb530
-
Filesize
1013KB
MD5cf289fc9a6f83ba2ca2b59d91acc530e
SHA194b14017211e451807229f82ecd1d4b504a7ba4e
SHA256210d9b0b4124076a4986313a0431eb6d538c21416eb934f65a9da41297584ea9
SHA5127b6a1fcb581478ecaec8b0e4fc3ea6408285fbb7511dec0a36006b4a99bbad5af78653f9d4e97ece639c8bdf09a4ce22379373a7d9536eb6899f1a4f1f134433
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50e3de21f615092d5050b9b42a7ef0602
SHA1427535b55707babb48ee0195bec735e7c7fbbce4
SHA256aa9d954b7c15e3b1e30c833fd89c201caa18c5ba89641ac33eafbb98942d640b
SHA5121a4c4daa353b06da989dc9f4ba0046fe9b66a5e89d2208e40c8cecb7c1c3adbcfbc2fb94745d5cc57ee12b245c5a5b8bf17a90c46a979947e7bcbc905e831683
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD5eb3ce4e4f69f1dbb4a6bc4ce5cbb2f63
SHA10f57be7f9c0abffefb827bef409f2de6a91fb207
SHA256feb3befabb2cb10944334c3608ca11c86c3f5661f7ba4c707ec48f55e182f2f3
SHA5122c9a7800dcc400869337a3fa5a664b78616e89916c2c1cca5b99dc568d0a9686d87ea31bdae087524b32848482e4b155d7e9835ccb07232c531589aaf9ca0d7b
-
Filesize
173KB
MD55e555df3f2f0ec57ba03a699f7c5aa4f
SHA114bb27bfc38f81725abc1bc11b7c2a051ce488c9
SHA256be14966efc1952aefafaf6852718dd3f5aaab35db2f6a1eb27694ca756cce7f6
SHA5127ee2ff1c7059e77fdbb0aea0c85f0ff93fe56c298ed27390408e92c57db3bebf6ccdfa6249404a57aab48123e7db2481772ab5f0e67406d08063f07150702518
-
Filesize
16KB
MD52e64d369ecb8c1219348d34fb0f2d130
SHA1715757f17342d5db9e6d8dcd7e10e112a1c48064
SHA25657e2bf261c120dab7a0ee3a5704d444ed759444029c9c4750a05603263dd63d3
SHA5120665a6028be41dbaf0d14a9c0e1ead1ab9479b8dfedd11285b3325cb7af0fa416b5a4f7f18b2b78171f48d7bc94a59afae77eb4112b1fde69f34e6e9e82ec3fb
-
Filesize
2.1MB
MD575a3abe377e4a378876b10c91badeb75
SHA132eee94994688e8b884d4e65de67586493e399b1
SHA2568bdb53155801e1349426b513ce50682e1a99df380e8c242d69814dc060e09b54
SHA512dbcd793fc3e23b8f70553fbf2e65a15d3cea724b2d6864668aabdc7446f6db25dff160a982a9f8686708e6442e27ed622fce3e1ef23e130976a8263be9581271