Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19-10-2024 22:10
General
-
Target
b1f06bd9f814003fa09639a32d0fca69a663abb7cc3aa19d4921696c627cbf29.apk
-
Size
2.9MB
-
MD5
8e8821b1cbde994a83d43a979455740d
-
SHA1
efb40a7561787007c29a10712d889eb7998e1a67
-
SHA256
b1f06bd9f814003fa09639a32d0fca69a663abb7cc3aa19d4921696c627cbf29
-
SHA512
d11ea3e5fa0be656a0910d43ce95391b1820bb0eee6f5fa4db5b21af90b08281204dee3050fc01c8f24678f81f5e91ba3d846d7e6a0a57e05f2f02fa22ea25e5
-
SSDEEP
49152:srC1YAVgW8O/a23ZOZF/XLdek+14DSNGMAPsxZeSsZgtg0h5MQdVQlHXg/x/:srC1LVgWO23ZYbn+14zMAEBby0rJdVQA
Malware Config
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tecisopojiyo.bikuro1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5d781a4001323116cc3ee6bb6b7296f18
SHA15e1a21ba2be3b74d1a54880207a634fce093a710
SHA2569ba5a6c4fcb9bd3dba4dbee339a99b1c619cceb16ed41ca2958387770646bbdd
SHA512f22ebe7f7b42bd706f64cacc83dc1bdb9f36ea6e05ab99510dc62716adea07fe9c79feb0c78c805df2b3ee8aa442d070b93e6e8c4bc8982a692852820d616ac4
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD59b45b6bb001316733f1636d9f8d1c9cb
SHA151438c2e9ec0d6c932ba068851a1cc6f2dc445ba
SHA2563149071f5a287d6cb61af42ba4b8b0511286359b41cfdcb5fc36981ab05da1ff
SHA5126ec286b13b3841bcf2e3ecf65f5eaf199d5aa3d6fdc97a0f17ad5ed9579710c5a21b4f1a3bf7424714a390444a6c1a3b4216ab9cea2c1ae5a0b9491d951f14c5
-
Filesize
108KB
MD53b9c1c600a4c4d05936c7299eb383fbc
SHA1693826d50428b4072f00cab8df785b3cea9b0c2b
SHA256de4c087dc71007bcafb9446cea1b46a9414a4b3cc0708d9c2d49ef888d9c11fb
SHA51278293ccecab472d0b41ffe8b366e7a674c5855a11ca3ca8c10f8badb6e49feba48ed82762998bce48da0871d8c12ca145c90a80124b1375b98b59ccc186126e5
-
Filesize
173KB
MD53dc9ba4c6301ac225c61bca362a530eb
SHA18944c9dd8b95b408edf4f26d81659250a648c4d5
SHA256c993a7fb1edb17d64eaf4fe38f693d4fc7a318f28f39ca0caca22b3b9544be5e
SHA512d77f47ec86649575a1ded09435f1df93b664655f9957aaa0b91749b02c69dc25da1d1ed6728e2e74f223d28ec16a40596c7ce8f390bb7742fd75196f617b8060