Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
15-10-2024 22:06
General
-
Target
9f0633f476c92fc3d5ea9ea7bab266b3f07c4b40e08616893201a2b185e905c2.apk
-
Size
1.2MB
-
MD5
b9908f5339622b6dba49a50475baf597
-
SHA1
1876245d7de888aade92da03c55e2533f220f055
-
SHA256
9f0633f476c92fc3d5ea9ea7bab266b3f07c4b40e08616893201a2b185e905c2
-
SHA512
5d8da9afc0b08fdf41abd937693ef853888ae2ec0c2c5e6aaa7a2e49ffcc2ec6e1c3799f2d4a2e6e97029ab95361c412d439e44fad9b0a8c0e3cd51234672b42
-
SSDEEP
24576:OAQxRWD4MqJwh1t8r1ZoFOVA6dPe7ND7g8n5:7QAs0t8BZoFOK6dPe7R7g85
Malware Config
Extracted
hook
http://154.216.20.42:80
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.OHZbOrUxtfAr.tdjgFdEFzORU1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50d1dda0e2ad63265cd30f5718f291b9d
SHA10de14fb2e07889205c1dbeb3f24f169f19627646
SHA256352457b739c057b136b9bf6a56c534515956fc8b6bbf1e2fd03784222ce46bb7
SHA512d265752c8a62d6d50a382d1ed59cc3120efc048543ba80b2adfbd37682a750eae21b2d02555c4c9e759d2f09e935ee848ec886c0f7aa7edc926726aa36851eeb
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD547a69075f43d4ba31e21153aeed69d13
SHA1bb0cc626312a666c88ae467c1887ada12982c6da
SHA2569512fed69a98a145494876e87530b753af2f279698509887b9f8c41839b0d349
SHA512839cbbc4ebe52f0583201689dcd00ff5a509f022a36c022ba0739db40ed2caf1e4945a949eb956f788a8ccedf0177578f4a9436de9fb9deff84f76bef211469c
-
Filesize
108KB
MD560671c0bb28e3c9997dc10b1000f5711
SHA119ce8cb0b46bd410ea8a54750a80dc9058885157
SHA2562a9516a3e32397c0438ff3ed53d9c05e059640c821d3a929d16365c37969b285
SHA5122ae3acde853cd359d0512bb6db8b528e77927d6605afc8776290bdf6bd4e7440293447321e5841af8103a0b4bfb41c85dd49dab3bac2bc831764b538cfef3b32
-
Filesize
173KB
MD5fe96300b1c9eec64cf8c7ebc251dd08d
SHA19f6a4cd5e593acf072fe2db0f9173f9e0e25f924
SHA256f056ddf169c4b19a270425802bb7002bc546c3beeca6e3741c1b83730e3b45cc
SHA5122e6bbfe1be88e5402dc45148a9f860f5f0596f1a16e25044ed13fdbef0725317363ce56955b2248019500b7c275c5f612c64caef494b80732019592501ce7adc