Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
09-11-2024 22:00
General
-
Target
23163860ee2f9415492006cce2ca696a8f7f8fc9a4c150b3c9b9d906cd333eab.apk
-
Size
4.2MB
-
MD5
7177f9c16a5d9d3da2e23077bb6063dd
-
SHA1
636e400419a43b96d0b24226dde82adf8c5e6b70
-
SHA256
23163860ee2f9415492006cce2ca696a8f7f8fc9a4c150b3c9b9d906cd333eab
-
SHA512
3562e4edcde62bab61a9e8592f44911e475dbb97510f0cff5328dd2319738ac75be2db74261c3a888812bd2dd6cfba9ab784ff948cc751176578c17c94152ad7
-
SSDEEP
98304:kfPMPRWmSmyV7gUd235dbYR26/hgMCHzLYy8LVwdDNipIplD0b:5TUg359YI6OVTFTTnDM
Malware Config
Extracted
hook
http://91.202.233.15
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.orusfeeqs.qeqbzstsn1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD593972e2debe931c8e2e45a4de13ea0da
SHA1bcd8f440911dddd22b416ea441c44dd0291144a7
SHA2563e5d44cd7903e57a4690cdb6b13fddbfda9317f6063cad5c347b0f873d5ccca4
SHA5122533a5538b831fdf445aec436ff0c8e79ea68b44a439d442cd495afe3322c30f09790f67bfdeed681f2b33c3f1f36e9b20fa5d990b307b4b2c826c745b87ecf6
-
Filesize
1.0MB
MD5be487010f073bfbe69cbdb6751703e36
SHA1b02c50261f0dd7f8f1c0dcb3563c8b84ed59c338
SHA256476744d81ee0971ab819a713e8e83e5281d702f565bbd0de17517f7f5a887f96
SHA512b04d070dc3d04f606a2f2c89c8faa759217f1400f16b1fe9f502cca91e1d72ad3c842d58238332fa42c409293cb218163ce10c342fd781738fc3be0c124cba85
-
Filesize
1.0MB
MD5b314f33af741db0ae05135b8dd16e177
SHA1b4669b808dde191f7e63a33e1b69870a46bbd677
SHA25639b85c62705eb31aeb1ddd4ddb7dd3db702f14bb7d114ca5ee94744c2b9b4e99
SHA51229c29218ec5dc5757c9b84c95b353c2546dcebab049c71cd0d833f89c5a58f836563f8143a58eb086fab9e2fdbd9dfca4e86159348cc7c885e4637d490cd8e0d
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD51a2fa1b49cb462b103576dbca7745f84
SHA1e9a660a99456620a4bf4faa835bc45c9698d2f92
SHA256f8274c5cf69596a7088f676cdecbcaf3a4343cf987f331f0e37ea68300b2fd5d
SHA512b8883bb0f2877f0ba9262dfdda7fd169cd9aad690484ac46cdd33dd5cdb2f96b34f7c798ca35ef54e4dca5f86ec1514798dd85ee065158e64794ad33609d4b92
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD515bdd059368a331a01b5e2cc38da2f96
SHA1ed3fb5e93e9a82a8ca82640b1dfa060d79cdf9dc
SHA25657076e69a9dc20be0712e95833a2cd557046773dc24efc3de94322f505432ca7
SHA51237fea0e70881454ba67484f614a514b34920a51adafc4e7417804fcfa22c354d4768def4c05d3aa084867382d0935546b179494bc4132e0309f518d9770a05df
-
Filesize
108KB
MD55b1dc88db6d8dfe3ecb4c11dc20beb7e
SHA1a17a6077f7b34aae11237fe32e717a63d6d89a03
SHA256c6c65d6aa5211775f612fc96b9956e8790bf5c723fbaf7790ac8c1b8956a1943
SHA5126d67c9046c8ca6862f99acb7f9f703c958d5c1782260c8f1d564d8a0ea4716145149489757387f28ff88eba354080667b0018ca5e592c0ccf5913905a1472b06
-
Filesize
173KB
MD57239b313238ef0421de60306621d2d6e
SHA13d0f43f0a0117603f2e07884d2637aeab7d265e0
SHA2567d4b7e22f8a92d9b6228f60c28208a21a4c9c476581c449c63b1156dd1c8bb64
SHA5121beca7fe4173695c568b06ca6f3a4ab535d67a78c93277b4613e9b3c4d56f0e510bb85ff8761068a298ece44917cc93c1e6f4da8c24799edb8a5feb601de8ec7