Analysis
-
max time kernel
132s -
max time network
143s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
05-10-2024 22:04
General
-
Target
417a2bc9975c4c184402c6872c9978ab8a6c3c984e91bb6cbc042a0b2f0907f2.apk
-
Size
2.8MB
-
MD5
26d523c39669cc4e662d0a13e4f470cb
-
SHA1
4f1d247b19ee92cf177ff3a348b56dd74890d4ee
-
SHA256
417a2bc9975c4c184402c6872c9978ab8a6c3c984e91bb6cbc042a0b2f0907f2
-
SHA512
1be76b024c796d11c6302af03aa9d07f0ca896ffb2deb4d518240f20c17ea828774c541573c6e3ae56ab86430e5ea0d5590a5f774365ed1b6b27068faa95f3aa
-
SSDEEP
49152:uOEfL+03bbYxvXQorgrONkfFZmklGW+w8RD2YzCLO5iQuXv3g//J:V+L+03bbYxvQorgrONkfzmklG7RBmQum
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD53c875791bff9aadfd422af7f37e1559e
SHA14294c76dd7c7e3dbcacae52ee908459f855b1364
SHA2565a95193aa4bb0a3b726e35f7ce0edeff3d7986b8055af05f5312eb9ee24f67ed
SHA5127cf536bd39e9044f96bdc81b4794e27c282ec5ff3810eae80f955d34ebec2be871ce180f0fe1a5824fb654f014fe9f7e54292eeedfc550d393f272be48892dbb
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD50f9f99fa1774878053fb3c2e0100042e
SHA1352b4b0aded56ee00aca8c13e52396ddc56c909d
SHA25650b48669c6a9f131476223a9434b5341401cca275390bf4e9e8648ded3c610d5
SHA512f9473b20afe3f156627528ec160b73704ae7eceb780b0aac6d750f52df38f12b27803c7cd95faf720ee7e4a67dfe520d17e41e53f548fa661f6dc5720a8dfc93
-
Filesize
108KB
MD5a56fb22bc83e8de124b488f7375fe581
SHA12b17c2535caaa36ae07869eb21e88bd8ba5e2e98
SHA25667e9049ccd050b67e3955d7f8c1367bd9657ba8bd34ec174a1aeb267a4badbdc
SHA512715326623efd458ac371286a1e181bcd017b5952f6b9c01a7fdd09e3f14ab960874a7cfb8fb0508acfaa9757909825ef89322697b2be8b883f5cfb540785f118
-
Filesize
173KB
MD5fb68f39dc6620fd7083444924db28fdb
SHA13457f5031706b7c330826247de1640355a88b5a2
SHA256a1f1cb6e639f71b3523ab81b50e36f035c5d3f608bdacc7a9f675cc34ec75846
SHA512b8de183316ff160e3d0aa7928822dfe0afee3f71d963f47d1625c49b2fa3cdb7a80b341c7e7efef82e2824d5a9616f3241e2cae4a839c40dcc1b5f2bbe03910c