hook | f2ffcd2542733ed9860218ab2d8b905106b103a2b6dad14b94559cd04e88d596

Analysis

max time kernel
53s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
17/10/2024, 22:08 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2ffcd2542733ed9860218ab2d8b905106b103a2b6dad14b94559cd04e88d596.apk
Size

1.1MB
MD5

8e7ac92807a0630651930cdcd3fa0ab6
SHA1

cb065ded25bd356fd74cb53a49adcf66a770b101
SHA256

f2ffcd2542733ed9860218ab2d8b905106b103a2b6dad14b94559cd04e88d596
SHA512

698440a4fc62b0b1a79b95543c8d411822953423a52dcd11003ed0cbc37668ec7f380259ebd11f9b8a2ef08460af77e1ffce28017abf8366fd9d84c6e0fc403a
SSDEEP

24576:3eQJF0WOHTmMXv3OdylZ50WrP9Ke/TpKPdojyGVg/AZVQ:3eQzOHTmMfedyDrP9IVXGVg/qQ

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

AES_key

1
3141317a5031655035514765666932444d505466544c35534c6d763744697666

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.tencent.mm

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tencent.mm

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tencent.mm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4807

Network

DNS

www.youtube.com

Remote address:

1.1.1.1:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

216.58.204.78

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

172.217.169.78

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

142.250.180.14

youtube-ui.l.google.com

IN A

216.58.213.14

youtube-ui.l.google.com

IN A

172.217.169.46

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

142.250.200.14

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

216.58.212.206
DNS

null

Remote address:

1.1.1.1:53

Request

null

IN A

Response
DNS

ssl.google-analytics.com

Remote address:

1.1.1.1:53

Request

ssl.google-analytics.com

IN A

Response

ssl.google-analytics.com

IN A

172.217.169.72
DNS

www.google.com

Remote address:

1.1.1.1:53

Request

www.google.com

IN A

Response

www.google.com

IN A

172.217.16.228

216.239.34.223:443

tls

116 B
40 B
1
1
142.250.187.238:443

tls, https

695 B
40 B
1
1
142.250.187.238:443

android.apis.google.com

tls

1.1kB
4.5kB
10
7
216.58.204.78:443

www.youtube.com

tls

2.1kB
8.3kB
17
14
142.250.187.238:443

android.apis.google.com

tls

4.3kB
7.0kB
17
16
172.217.169.72:443

ssl.google-analytics.com

tls

1.4kB
6.3kB
10
9
87.120.117.119:3434

420 B
7
87.120.117.119:3434

420 B
7
87.120.117.119:3434

420 B
7
87.120.117.119:3434

240 B
4
87.120.117.119:3434

420 B
7
87.120.117.119:3434

240 B
4
172.217.16.228:443

www.google.com

tls

1.4kB
5.5kB
11
12
87.120.117.119:3434

240 B
4
87.120.117.119:3434

240 B
4
87.120.117.119:3434

240 B
4
87.120.117.119:3434

240 B
4
216.239.32.223:443

tls, https

128 B
40 B
2
1
142.250.200.46:443

www.youtube.com

tls

135 B
40 B
2
1
142.250.179.225:443

tls

135 B
40 B
2
1
142.250.200.33:443

tls

135 B
40 B
2
1
216.239.32.223:443

tls, https

128 B
40 B
2
1
216.239.32.223:443

tls, https

128 B
40 B
2
1

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

www.youtube.com

dns

61 B
319 B
1
1

DNS Request

www.youtube.com

DNS Response

216.58.204.78

142.250.187.206

172.217.169.78

142.250.179.238

142.250.187.238

142.250.200.46

216.58.201.110

142.250.180.14

216.58.213.14

172.217.169.46

172.217.16.238

142.250.200.14

142.250.178.14

216.58.212.206
1.1.1.1:53

null

dns

50 B
125 B
1
1

DNS Request

null
1.1.1.1:53

ssl.google-analytics.com

dns

70 B
86 B
1
1

DNS Request

ssl.google-analytics.com

DNS Response

172.217.169.72
1.1.1.1:53

www.google.com

dns

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

172.217.16.228

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a1515acf5117f86488c1cd4113ad896d

SHA1
c0c8130b6695d1131f4911d0c90d52a3f6428a6a

SHA256
5627c4af271a6ac0dc064b96cb5c8f331861acb565ac4a4edf8972e32ea8dbfd

SHA512
2a3140d2f035e5f1f0c56c18b39282cffc51a44d7487caf782c282717c4be68ac9b8c04cc5eb47a72cf07b8f42e6d5a559610b6441f5de9a334d7ee9746e90ee

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0af80b8be8f8910d9cbdb6a848fd4541

SHA1
76eafd23f2ce0fddb7d3078e805ba53abd6c0b3d

SHA256
668e01be6ae1acc20235daafb7208f52b36e2afcff7c68f3b0ee780e4b54a9ca

SHA512
0064390d408a776e2e1453abf924b6c787da6de623b0ea09a890caa7392b959de014b5857c3739ef2e8852357ca33287e6845a8d2a42ea7a00d1b4ed70ef79a5

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
2b7b26e0f18649bce9ba3f0f00023d08

SHA1
739103b4526dfae6304e5e0e43369f7d1a2b0ef0

SHA256
994bf22b82ef178d989e603490f92bc47db6593ac7b14048bf26055bd042f8c2

SHA512
849b894861a98d8c11bf14b13905a244c7b1ffe3b9bdea473daeb551040c8a6ae077a26e4505e354e014c5465d8b47df2d4923571e48434bab3fcf4b704587fc

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b529fd4215c86486a6bb4e061d23e188

SHA1
19347291f354e7e4dcf2c1ad116ba6d12153395a

SHA256
362377b67e9b14f5e7facc9f8896f978c22c3006ae69bc6a34abd6bccb936af8

SHA512
ef18ffa92db9c9783c07d712c5f2b4f866742de076dfc68720d5065582a651ea3bdd67b2dc3875bcdfffea755060029522562a47d11b195ee35c31c9b20dda8c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.