Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
18-10-2024 22:02
General
-
Target
ddf3a46d2754b84ed30e77b519219262d3334031552d5f582dec33017edbaa41.apk
-
Size
4.3MB
-
MD5
5cb007bc21cc46bb930528cc26b91dd5
-
SHA1
c9d7444d4d0d82ef678b98074fea6db4662766f4
-
SHA256
ddf3a46d2754b84ed30e77b519219262d3334031552d5f582dec33017edbaa41
-
SHA512
b1117d6fe890856c15ce6f28f1b2aa279da92d109f444c2f991efd5396e00ab1b75bb4ac6a368e08cc5046745ee62a50a04925a1cb79d906f6c9c5d7f5ab0a44
-
SSDEEP
98304:ue/3MuoyjkyI6hZmaRWY42mJAt9hRp5sRjoisTbsmiV2v5OpXi:RvbDjdI6nRWYx2joiri
Malware Config
Extracted
hook
http://asik37df.xyz
http://va8fjvz.xyz
http://kav9kva1.xyz
http://puti66bv.xyz
http://brev8sv0.xyz
http://uy27dhzca.xyz
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ysrpmcmmi.rxhnapfhh1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5456b247c526a9eaf44675ccb8d5e06a4
SHA1fd36e58c78391a2104bb44fab24a0e7efb73df3d
SHA256fe86bdd0f9a6a6fd9dc81e9be0237b2221a6d1859d59499f2e9734c6a6e2b81f
SHA512c1417ce12e01bc8ea1aef1fadc0c752ecf0310f88bc02b3bfc21a2ec8387bb82a691e4997fe27fe676a66aaf5eaed717d36a171cf9f8893356f81fcfb9070982
-
Filesize
985KB
MD52a7260a9ef081de8543bfdea2ddfdbd7
SHA1a50446f83c72a6c38a5c3472950db2a7ffe07bf0
SHA25668304dd948c833abfda7ccc70e5c198f6a90ac43ac0430fa7792721489df45c6
SHA51202ff4b6b4a76bd3486a89d2898a0fb6b9f74d681f3c394bc4df4ae208e72a670628050c5666608a245d3ef52efc7d19cce182c32e37f7fd1b9718ca8ca14f5f3
-
Filesize
986KB
MD5724cd5d0316eb515cdd8a007ddc1b982
SHA1ebeaebfef153bbca116f36a767d02175a463eeec
SHA256aa6eefd8de41787c68d5f3b1c40adc473793e39275081e54d9f2de87aa381283
SHA512eb92d125776164ed20db655ffeba2f863a9e30101837d47e18c8c51185d628bc346e9ec99139d1cd543a89bbf4d9ec46db6f47fe320bdecb0ab4eb3f0d690363
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD558b4fceb0fba83cf09918a864428d493
SHA13f4e7ced9472b55d1c902527d320900aea91f791
SHA2564d38324f2893c923e6ef79d0593e7f085d594f473fa5f5a9892ac8c06276f27e
SHA512a3883657b3da5693e2bd6b9e7d154f98f1d6732caa82a1d931f218614764a4ad0ee1e0216035d976a731291cf40464b3ecdfb21f4ad79ddba733d54a0b744bdd
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5605414b0a1e678a7343f9c08357b9f76
SHA17adee2131f0598ad0df8a50e7d59c1064a72aa62
SHA2564b8c1e4b8c48b12033d72c390cc0ad0d4c6210a8fadd9c4524ec226dffa15e5a
SHA5123dffed2e75460b0012f4c7e81b50d297720584791abc8b96747b48f9fa8eebd477bafe47f58e5a602213bdcd5f1992024f45203f79ca55deaf78a331aadadba7
-
Filesize
108KB
MD56a65fbc31f1467863465983de9a3edef
SHA119fc156a0a10a7ea86ce4e750c937a1342cdbd88
SHA2569a53638f0c91559cf7d3e38e37e4011fcfb4863bee934ec9883f6fe9417467a7
SHA5124769a9237297faa859ce07f23abee6dfd2e997776c7d82e4005cc12bb3904d92a43dc7414cd39b3e6697ad90dbfb4102fb68afc9d54d5f1666820a3ab5f8b7b3
-
Filesize
173KB
MD5a772ef7e4ceb146be45cda5c8c40401c
SHA17c563e165527bf746cd850f47fb8bddd1b7ae2aa
SHA256b7e1a805ce9544cb70b9b5e4fbe85182b3dd246d4c2dcd1d44c8431f211f8656
SHA5124550e9347b073496a907144193b969c8ab0987b43e39539c27629e16085feaa9bcbfef97af7ae66e0dc4b64bdc6c8de7223340fd18deb1e95081fb0e03dea548