Overview

overview

10

Static

static

10

cbce30328d...75.apk

android-9-x86

10

cbce30328d...75.apk

android-10-x64

10

cbce30328d...75.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    26-10-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbce30328d1291571f460d90a7a97614dfd32a3bc7723dcd4f06d7910e9a5b75.apk

  • Size

    3.8MB

  • MD5

    10a3b239152d8f060dd0d77fac5f3556

  • SHA1

    47dd6ac0b2ecb8ec28cb8719371b548df80c0227

  • SHA256

    cbce30328d1291571f460d90a7a97614dfd32a3bc7723dcd4f06d7910e9a5b75

  • SHA512

    63e2ec4c3a0bf63d66ac3f8e33b18e5438c987d96fabeb2b327754b1eb66320b8590a99cbe5e02d999924ff3c4bd1841a1bffaa12fb34e3618fec1000561abdb

  • SSDEEP

    98304:yiEfVKK6yJCS9l0mWY2+BooxkLAYtokajS4w:yii6pu0mWKBodsshpN

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4504

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    428f27e010799db115f9063823359192

    SHA1

    75d0355cdb9e346bc531430391ccb0bd7d249799

    SHA256

    9428f8dd24f4cf0bd84ddb9c739b828c89ab66298262a801238d4327049a267b

    SHA512

    4b6d7056367b58a399854bbf88df67fe51d6c2724df9b38fb4286c7ef8a3ff23abca15b7c705fbeac0f1b951aeabd7dd1e8e1e995057a9c50608ea8772d9461d

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    4f6369a678c50b1497b9d779f6d35ce8

    SHA1

    54d2773f30a45e567ea0de532cfd9667d3a8648b

    SHA256

    b77fc16f64e50ac661b969556b88aa6fa01e7058fdede34dc0036e9325f872a4

    SHA512

    4d6865f533c1460fbc1c86b6acff153fa566b8beb7cda3944996f149d5d5fc95875dbad9bdc18262f4223c57801ff3c5e58316bf02a4c32d36d65d9ab1d2faac

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    d9803df9b0edd0dc67b66531e3ef2c94

    SHA1

    1c8ab7ba923a711ce06c863657b2456072477f01

    SHA256

    d36e374c7aa7fff70d7f967e561c2a6ab7ef8ba0d8e43da5dd6c9d9a3f24a10f

    SHA512

    468a90fdf05e6a4a89f29ec941192033baf270204d980f14d093beea8c975b71cd5d9635de643d632118086024129235f6bc50180890ffff68c15380152d8bf1

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    708bb7e23dd7382035363e0400455e94

    SHA1

    72f6a6d6e27c604aeea6cb6be0fe8b18d4957a57

    SHA256

    7f069ca7e053c7ea0d90ed8a53a4860762f3f1fb64364cdeaccd63a63d264ae0

    SHA512

    628ae4752c6528c89d2d4c25c5f86b7665fd3b2e02fe8791e142953adc788a0745d03b798af7d24f32360b1cf14a5a29d3d3b098ea6b4a423cf127ab5339a37a

    Download Submit