Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
23-10-2024 22:11
General
-
Target
f41daed5ce4cc63babd18185523ad6db019db922696b37244971785bc14e9628.apk
-
Size
3.6MB
-
MD5
0798fd659e5fbadcbd15c8b4da8579e8
-
SHA1
7fcab6794a5e70c2b0030716e65e43cf5340f5fe
-
SHA256
f41daed5ce4cc63babd18185523ad6db019db922696b37244971785bc14e9628
-
SHA512
52c12ac61f1658d55ee1cd243c4967057173c92467ebd60df140dade8e29a428414cbba75584ac09cb3373b87661812e29c4e787804e3ab96aa0921e7a0bc283
-
SSDEEP
49152:MtYWa5T7qkPTH2NfHbR+Wh6iIXOOKKr5MjjcTmKdreFWphPraYkdZRi1vPCtHN+r:l5yMSVQWaeOKUMPcTtRp2z0lKH/UZP3P
Malware Config
Extracted
hook
https://ws.meangirldforvep.online
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD565e34993890757d40bfd9d016659a432
SHA1914abe4b151e47189a3ab5999bccb8577e92bad0
SHA256b317d5a04b63d8697e5ab0ad3bc96d1d43cdb45c6f3f57991878c0b1ecf6af22
SHA5121dcbd701703db78e54534cb4c8042f7b98333d8abb6ef77952682595f3a28698d9c42e0b905348bb83a74e7a7ec6192c2899d9028a18c2276c0340962c91ae90
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD544bfbf817e12a1c1324771c28ca9785c
SHA18596e0841b7d32826587e7bb8c4f4c3d5a2e1809
SHA256853f1e9b07cd835be9ec2eaf844e7540bc34d35a8173aabe34533672d04fe6b0
SHA51284e86222b08832af4cc8b61ff266b9251dd69955b035614e003cfec53320b0f3e2b5fee14ced55dc8106a9b7ac87f4f94195091067ce886de663635f32f4e84a
-
Filesize
108KB
MD5f3cdee3118004ab1489e27ada95dce7a
SHA183fb29db8a985c09f35d23f830d24a6b2843fd37
SHA256cbc1157c36f92092e191dc80201f4b414bf36c9476ecf5fc1a2a6bad70a488a7
SHA512182a0f7d4ac6899944fae11288fc9cae9723d6e24bfd7ba136ab4122d3e2c148d20240864606628a46f8cc22d1082096d0ad6f7fdb5fa977c420be24b3fab684
-
Filesize
173KB
MD543f3d8174dc01a08f9c5f08d2c30b413
SHA1821f200e8c2e504748896ceee4babf61f99cf04e
SHA2564fdbbece7aab6b5eb4d7e1ef69f4c09081ca23825a6c7744a86c6ba245a944f7
SHA51238b6c2a849d2f42a5c933a1937471a514f3d7a8d9387615a26df70f41fae62d2360799819d81c9c9b80011898ea93cb17000baa69e5f7c15b3f9a6506577ea1c