Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
27-10-2024 22:03
General
-
Target
a5d940a7ef795253474f554c0c7298ca46f2097ada21963dfb7fe09c0a9732b6.apk
-
Size
1.1MB
-
MD5
31b9bb86325e4780ac15839b49f3e932
-
SHA1
0eb27492069645bac5a8a8530c078174182800de
-
SHA256
a5d940a7ef795253474f554c0c7298ca46f2097ada21963dfb7fe09c0a9732b6
-
SHA512
609c07ffda97b9b3e8c20e68f67d43edce26bb0c09063da4c905f0609f9ba8dada2621b755380612eb9239222510a794428f6b443caefb87455aa040012595e4
-
SSDEEP
24576:t+se2lOIgVKmMYqEOuR6K0TaOUivtl+5jPWojybAjg/REb2/:tNsIghMYrO+0TaOPvtlZXbAjg/j/
Malware Config
Extracted
hook
http://127.0.0.1:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wazukunacico.taxira1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD548d16a6774221491222640b7b7a09d24
SHA1a82a76782360844535cdfd4ba9da2456c3997015
SHA25695a201d9d43190025853e8a3b3745ac57b674553b30bb47926206af9091dbe0a
SHA512cf1500080940aef4b454dfba9fcf7973bca65147eef02ce1297a66e8a7f1a984d5f101a0ab1db7e0ee388551d604ac996890b4b50c1cc912c00ca121023c4568
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5742b236a6ff27945b4759deda833a931
SHA18312c4dc8a1fc39e616af2e2b5800ea3e92e0034
SHA256d1cc03cfc8254cd1152b579b8aad7dd6bd25f82a1f095dc8c1dade10c1ee0c0a
SHA512cde57bce4b9b3ac48a553ea91de861b7cd7b5b5bec878321d72deea3aca967672b06fbb78809d5ea501a92f7a908348e555f74ace6b5ea6a607c4852bc78b46d
-
Filesize
108KB
MD5605fe2a1c0ee285ea2cb1adaf0913822
SHA1a89e85b746c200839623564add6a1142b5db12f9
SHA2565b90fd2cf0d22206d3c2904366dc1cd9a5bab801b5944bd9e04700b5e3a802a2
SHA512308526c8cd54b449b7ed9f0eb6a34d1089e4583c825111dac4049b26e7c1c3ca71097f4cc6c58805cbea94002d46608bd070ca4ffe83956f6e94b426e60b5ee2
-
Filesize
173KB
MD5f85227a78c07471ffa5299a1641615ad
SHA14e3f96006ab0ab289910efa9666e4f6c70a194eb
SHA2564476a91b4aef54262edb023bacc1b97d8f2ed2238b67898059066120c40b2bde
SHA5120ecc9f79a1db3284957edc1023657772e3ccde6fc4db56c28ed82f4b26b1250d4e93d1b0178dd8b933864eda861524b5b8753c1fb72d115c72387965e7aad849