Analysis
-
max time kernel
37s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
18-10-2024 22:04
General
-
Target
ef1daafc0832d8c6bab1f6009d57531dc7a00831bbf1afddd16d8b898bf241c5.apk
-
Size
3.9MB
-
MD5
dd7667c44e4b076202bcd97d1cd0c5b6
-
SHA1
8bd5538d21acd6a24fbf31517884ddfa6445b170
-
SHA256
ef1daafc0832d8c6bab1f6009d57531dc7a00831bbf1afddd16d8b898bf241c5
-
SHA512
88ca4158e369608ca4f49f9d1459d2fa7c5c7a9503dca45ae4841471214dcd5538d244e019b7c0258425bfde21f7c7948e1cf003612a6d5fb129bd63294bc797
-
SSDEEP
98304:oZ2RaXyHSPhPlxtRJYR4pRWlaI9dyj7xUKObtajrjyj8:eryyP91YaVsUHxUDajrjyj8
Malware Config
Extracted
hook
http://154.216.20.101
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.neasqhpqv.isxurogfu1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5a66e283d6f2d2502e2502b856666d2a5
SHA16a9e6a66f892dddf8abcc9c9f92c8ec4bbf3c434
SHA256a624059c5a95732186b106eb69d5d74247652d9c7496fea650cb773fc04233dd
SHA512096e19c29f20810d90f36a0845147611340aa3353d89d9a17333d9075eb519ab5d595cd89b14baf55d11393ddcab80db2b3d508a5e100c42d5bfc7e7bd659ac8
-
Filesize
1.0MB
MD5f321641b80e1b8bab465d6502e74c39e
SHA18963bf1c03ffda671c23d7fd1206d868baa474d7
SHA2564c1620fa0fb5232b414d729536ac96fcbc3eb78ac858c6305ee657192b15d1ba
SHA512255edc3fb76c8e83881665ae39db86ef84380ac22a361e9d47d064754fa14d371d07a37672b53588d4bec34581b40331a2199c8bfd423951d2a8070adf18e957
-
Filesize
1.0MB
MD554aad71b69fd0dea398ab5950b2b09be
SHA12c24f45c975335c85dfe8cf18d694fdc124e2360
SHA2565c5d3f2e6e0cc2188e645bde8ea79a4d092deea03d00f30a38281c597b6ada7e
SHA512cb73d76a6fd650470e28ca5f2bb6283d2335d1a0b5e03600310f9c2ae1f6157387d5e0364df238350b9724d7b9cd71cb00f8cd7473d294d8bb02d0ccb7699cf0
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51d6b8d70e9112ad9178b13070cc4a3f9
SHA16f6d20eea026a259e0ebe08238d109b6be3a7fd5
SHA256c2ea9b7f58184a62d2ec6a12779cf7bcbe872694ea30d71296c2b66d7645fe1e
SHA512f70e806f7c6c14dc160355f425edfa459322edcb7e769bae583cc86db231038499275d1454188299cee120099eec4d1b742201ef94e326db4c45abe1051e2b69
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD56371bc31d34ac81273a4457dd38e5765
SHA13b90016b8da457d6bcf48704f6040d8a257707eb
SHA256128fc6c2efe2ab62843958cee37658484e6c058ae9723800ad7bd00ed025e031
SHA512a023ffd3472da77de0a8a9a020ccc0ea736d56b79b1ebee36fd7e6bce2d241515a9235974170c83d18f25d946025957e6efc3183a3d59a271496415274b00e24
-
Filesize
108KB
MD5f35b01fb9c4a631ba8b1278829778ef7
SHA13416c11d826938e30eb8bc3a207d797a05895b15
SHA256169f28fd73dbde58656e96731ca0fb2203fa2a4d5f6e32fc47eb2301891c3f69
SHA5123878a7710171699969e3cf3d6032dd26a0c49fd2c70ffa593ff4f80349ec8b878f29e2a3379be1fb94ff85e426673409561ffc93fdacf5db524d6faf9c256cd3
-
Filesize
173KB
MD5b6a97cb7cf06c7ef27f344e317f8bf51
SHA19718d9a1af163d66c9ba8f7d85cc580d362e07eb
SHA256ab699bcbee42df423d5293ce0f3e3ec93174c0c37b7b22c269a69163e647e791
SHA512570d256db4c412aacfd5d0acf032e2ff0d39a11f980198ae2755d28ddceb6295b67153f087fce84a416396c2783b20845d9600ccb51c754a049348ed3513b91f