Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
08/11/2024, 22:14
General
-
Target
8a6a92a7e95ee395c094a172eaec42394e4a68e0e7ddab3e3fc2d9ae40705139.apk
-
Size
1.2MB
-
MD5
bdcf4529ea9b43f3c46f3e28b0124d8d
-
SHA1
0c269d343d80d130933d06c13b8afe15e088b438
-
SHA256
8a6a92a7e95ee395c094a172eaec42394e4a68e0e7ddab3e3fc2d9ae40705139
-
SHA512
3f6fc975e3c91280f7ea65c696cac7fcf8fc5dbce4681af058c12ba0a0aacb24895edbfc5eb7db72757d11ca1b7d263d418d0df16a70b11b102354443c6994ae
-
SSDEEP
24576:Tw9pEHW3N1uxsq7BkYlAUyw9O+XV8QdGn9tNEqZrgSVfb:M9pEHWd1LYnlAS9O+XVHdGbNEkgStb
Malware Config
Extracted
hook
http://37.60.251.9:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD542a010a8174e78ac66d3849a0e598b4a
SHA1553e018267e1ceedcf5ec88709b8b10318a4185e
SHA2560ad3aac392e7381ea79b0993b0e23f1cb84b47f3d87a8451ab15b97d295c5fb3
SHA512334485deb99e6a15934d3623c07828b8b672c16584a49f7ab8e8e3da2348e99008dd46e493dd8fcf2f37d923f5d75bcb8e43b13faba7d57a7802ce8b137d257c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD50366e00d1a6d5e47f6e5903bafc22fcb
SHA1fd276386891f4ff49eeec9c8210baeb8dc15b74d
SHA2561e9822dcf6a02fb6026bf1ff918dab4c5d265190ea52d75bcb425b1c5e0128fc
SHA5124ee303e349d323cf20e021efe688f8ebcefafb828dfe7936edb04dfb6fefa151d0d752399d1208ab434a777066696d7f5b3e96c07d08c1700f58fce634f6733c
-
Filesize
108KB
MD5ce21f8fe71ccb32338760ced9bb46181
SHA1c05a4ffb8089ad25bc79a39f80637a5b2dc98a64
SHA256508b30b7a6a0bebb2220c814e75db068e9ce4b22447b4d65c362f49d9fa67a43
SHA51241f19871a627239f08d10edff9f4924abb72a9cd6bbf9b817d9ea37c0580de63ac5b5ec9c393a2d001efb095d8fdbc0f77ae576a2f7b7fcd19be9a79d85e4b38
-
Filesize
173KB
MD500f1b5fa742961206732b44c67f5cfe8
SHA12c60b29d5d4dfa936a89ca2927c99731502f4ecd
SHA2563e2f8b03013826419cd52f17822fe33e676589e26b24dba2d212fc2d150010e3
SHA512ecad505d06e5e38fb60c11af4855877fea89d6c81e75e79c30e5b28f7d63a1f4e22aea8f3b4923ef615ebe611c9e1b8c45a69f04c2803a6dae37561e1bceefe3