Analysis
-
max time kernel
149s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
08/11/2024, 22:14
General
-
Target
8a6a92a7e95ee395c094a172eaec42394e4a68e0e7ddab3e3fc2d9ae40705139.apk
-
Size
1.2MB
-
MD5
bdcf4529ea9b43f3c46f3e28b0124d8d
-
SHA1
0c269d343d80d130933d06c13b8afe15e088b438
-
SHA256
8a6a92a7e95ee395c094a172eaec42394e4a68e0e7ddab3e3fc2d9ae40705139
-
SHA512
3f6fc975e3c91280f7ea65c696cac7fcf8fc5dbce4681af058c12ba0a0aacb24895edbfc5eb7db72757d11ca1b7d263d418d0df16a70b11b102354443c6994ae
-
SSDEEP
24576:Tw9pEHW3N1uxsq7BkYlAUyw9O+XV8QdGn9tNEqZrgSVfb:M9pEHWd1LYnlAS9O+XVHdGbNEkgStb
Malware Config
Extracted
hook
http://37.60.251.9:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD52277d5a83fd5d1b899fd6eb3348045cb
SHA1dee7445d8bf18f6d99f0e2e8d0eeb2421ac4bc8b
SHA25626c75157073c3c7746fdf1022da0e00e2977cb32634862eddcebdfc82264686a
SHA512c91340c3c85584761a284f838c149bc1160914efa9a86887332b79cc42b12a58146767ce47a2a532442b46b8a2ce871ab8bf7cedf963729e2445377f73904971
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD586957e14b67a22e930839a28a8324001
SHA177d78612edcace41f01d50b7b600676e88159862
SHA256a4d40877b3a3fd641eea8b7c8e9860da182b280ee857af1a02320cb757abbcff
SHA512de0bfa5b04497482f6a02972c0e50e07eb4154168d6f5446d78305fcad93d267b5b297c9630786cd73564d3d909c34809fe3adfe0e5895ae9979e54a4d731730
-
Filesize
108KB
MD57f45788fb17a6cfa52186206be69e26f
SHA1a060b461d9463ff31db6850f3adb8c5b63e2b923
SHA256c7c00f6282a54c5dfbd8ffb6b38243b680da208e2a0f7e9e7d6495070d010636
SHA512d101bc3323534c2d93c592e2a874f1b519d78f8b349817f7917c8c4eefe0b387ff98e8aad0cc7d6f9e99d996c546310e91fa302aac4c80c4c6e7706f59f0123d
-
Filesize
173KB
MD5911d8af5fed54b72eb62a2d7b4906306
SHA1a507708a43115a9cdbb0704b398fc6c73757ece4
SHA256b7907ba645cba8d95d4fcac90397ffcabede1d19fd6e96f1360c23891bfff1d0
SHA512eb4e5714038038f6b1007eb9b7515a496779fc8abd28ef7e388ec00d6ad4636b98ac51f4647f2e98f656a8b221bc3a6625245602676d0d8519122a9b9b8d4e17