Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
07/11/2024, 22:04
General
-
Target
b3c5a8cf7ac5f1431baab06c9dd44a4a88382713bdf0cfc15e0584facb91c864.apk
-
Size
4.6MB
-
MD5
28e49cbe6b51f3bdeaed5b8d15e087b4
-
SHA1
6dfca961c780b40fe0fab1ea4327f56d55a632c8
-
SHA256
b3c5a8cf7ac5f1431baab06c9dd44a4a88382713bdf0cfc15e0584facb91c864
-
SHA512
ac25348886ea4c57dda439956a29ea26bc9e8dadd53140342606c337f831eec87d7ed6e88edd43d66726cb24b6e81d80a5c614df9504bc1daaa4679f1405594b
-
SSDEEP
98304:2uXa+3/EIqNSBs0nAa1rkjIgqXVV14HSFRe8hCc9XG2fGK/:2+snd0HrkMJVeHqRe8hCeuu
Malware Config
Extracted
hook
http://89.248.201.43
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.eeykwfxdt.xujtukrvj1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD59b27831a8f2754509a8782f8c98e1f6a
SHA14d6ef47be38e0a8c924fc593062e79e446e79dc0
SHA256680476b3e0018330acb64dedb2308f6e8b5721e4968165633518f348c53649fa
SHA512a8462297937b7ef6297d09ea9ee8f9ab469b47b20c911d2db4d333ff6a0c0fd7310ec9d61826044afc394805080e744cf73d9097897e5fc166131b0805f8860b
-
Filesize
1.0MB
MD58c9cacac61666d4388e3f3462c71d685
SHA15ecb5dd020289b2005bbc44f92e37770fe5d894e
SHA2563c9f1b117b76a5752cd3040b2ad4bc43460f10f93485a8ac0b6d66f0a95c084d
SHA5120f2de350bf340e882cacfd574a1aa91cfcc67cfe79620271a7d56352d1cdd0bcafb72af2daef166d276b01415ccbfdb00fba37270c1218e54315ed26c939a682
-
Filesize
1.0MB
MD51813f89393149e7420b038d3c3e4dc02
SHA13c09901e6e08cb97b860119e85663c3b74750451
SHA256849cbe45aaa9eefa6cb4d03b2f4e640d5d284ad4a13873e4bbfea06ada0a8496
SHA5122f587d18f37f76e07addd442fe4f2f0f0213e933b5ab5a78dce5485541d557eac18464f27f3c5ecfb91a48acf10d8257dcdc82d576e9a860c756959516f188e0
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d66ab71967d6246f1565f96418470493
SHA1452405ce1b7c57b37ac1803f0a14878fa0b8d488
SHA2567296ff282104b7e4fc2a151ee15c6a599bd4e540305a0dd60bd2b84aecc0df14
SHA5122acf33c12be515cfdfbfcefa3af7d78f27b68a5e0ac34fd2b488a038827328fac94dde1374d3c0561587ba27c5145f0a94d2b6ac138cd62a436f27f3013f3331
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD57f7ffe981a39f956b065276e6f2c435c
SHA1bf7d17001c8069cd3764dac18bc156660542527e
SHA256cd29701e01b16404912a6c249db1fe50441081f913b0e3581e9e9dd100bfaa0d
SHA51251f748151853b1d4dfc803df4a7bb541992fa957b85e2c48e5f9176643c75557fe7f968aa874aaae9ff1d48f20d321822830b54fad0fa83214302ced521ab630
-
Filesize
108KB
MD528020c6eb10373b4a4c51175f8afc9ed
SHA17dbf3bd84868a6154ec99f09e689eee16bd2ea6a
SHA256ae3a43a0bbb77c880b3367f19dedb801ca0bd780ba5baead205c38d02ec3760e
SHA51203e5d24514c95957aa8ddb92a91bff83f99d44a38f5f02289d4cd128df0de322ce408a9f8900a3925f1511ee5cf791558c3fa293e7075b6c245aee8d8cad33ac
-
Filesize
173KB
MD564235fa3ce644eea9e988dc96dbd7dd2
SHA1a4c72ba4953396442d267485a06878cf3d0482cb
SHA256a8b913d14e519c173836597023e2294192975c54380436671e00cf48a47c100c
SHA5125945b4e2acd230c38adc360c586331d16a556c0ab6c2892bf7f575f30829f7c1e8e66a13a6145463eb3b4009862f9b5f0dfb21a4b7dde483a1e2b8a4ca00cf3b