Analysis
-
max time kernel
148s -
max time network
160s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
11-11-2024 22:02
General
-
Target
2cbb04ab236430789c084780545d11d26bbdd11cf287773be5f1420f427f0185.apk
-
Size
4.3MB
-
MD5
2eba05c1179cb2cda66c00acad61a004
-
SHA1
90ff63ec475e57477cb1a1d265a4b842dd15d33d
-
SHA256
2cbb04ab236430789c084780545d11d26bbdd11cf287773be5f1420f427f0185
-
SHA512
478185662d80de6c9ea17d3247be09ee8c8626ff3d80dc283f3695a0175a2d167ee4290b013ee4b921c4a976ac7fe3d15dc7add07ee1579e8901a2f343321698
-
SSDEEP
98304:9COaWSUMfKP0xh+on7zxILr/x+igJjmJecUOX:ArDjfzn7zcsigEeZs
Malware Config
Extracted
hook
http://94.141.120.34
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kctllylbf.hknptwlct1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5a9cf1d9da332376a04cfd6fbef890b33
SHA15580e0d9c940c9f50da30f37ac311e7fb081e988
SHA2560ebff4af1404eaae9b31598e71623366fcbc98919818c9347e95b662f824f306
SHA512e56ceee94e9033f92bb30c89351eeac73d3947212a9144919a928ac2c3754032ac527043278fa5bdf1d35b195a1823e0582dcbdff7c74546e83b8da5e29fcce9
-
Filesize
1.0MB
MD5679bda600eeab607f8ab2f27b5fb6775
SHA1b4f000e43fa7e570dd2e632d7ff93a57dc6491f5
SHA256a273205875b8ae4a7ef865d73fc98193f0d0e686d2b667633319f8f55a37436a
SHA51265a2e5de32e1a079c499d71ccb9cd9c814284cfb7047c13a379efabf9a2119c3e5e9fe85081c56d89d09b8445315468c22727fc686124e1fbeef538fe49f983e
-
Filesize
1.0MB
MD53339d586fa2760db1dae1df8c17bfffb
SHA1ee86644485e3ac7e2e34e6fd99921c16a78064fa
SHA2560f8772bbdd6b62ace2380ff6a4a8412e57b5e7e2e53cddd91f1c12c04c1f6f1e
SHA5124881bccfcb23916185f38d31949c6cacfdd40e59240c8de7426d4f991368ab6ff4e70d9244d3f8e50a6c57382dd0f1af06342e8548d2776082a3b73530b6de93
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5670ac0296a6647775d8dab3095373311
SHA1a9a94df1c7a2a8cb8f539fb920a95af69d37fb79
SHA256745486206686eda7e4f0bf2aec4771ca8c84f17b7a38de1bae909a1822d602c7
SHA5129ccc4003d6cc048f29015f4a31db4d045b18126b7fa95646f8c1a2cb71f9da182db59153b153038c87d9bb1f0f8375f1038b8d71646d27a91d7dd86f446c1e87
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5701bad1f3219f4a6048e9fdfd4c88ed1
SHA1ba395ddee1cd11fc720506a07ce30089fcbb04d1
SHA256a83d2fb8f077a91fb952269617f57cc77272ab469a75e6656bd40e902c486610
SHA51214f15f7ae907b30e0c88ecf49f7aa1f3adc51a20c65a860f6d1f4d32ddf173a17b47ae8978fbe43548dd13ca9d33e1378df974a11955bc619f1a7f3e269536ff
-
Filesize
108KB
MD5eeb5c60a722044c4a09f0bd342440c7b
SHA1d7432d437bcc30b103be2eaadf4b3be282fdc589
SHA2568c949a968c58dbd49cc4b9fd22da81b624d4bfbb3f0a637d61f37ced3308f191
SHA512231d12b33651dbdb323f289e0b357f1ecafb47200b7b43bb39310eca8a12cc25a0c2c99471f89f9cffced47bd9768534b0488c0795023e78900897bf935064a2
-
Filesize
173KB
MD5239e01c6d32d4455bfb9e19c8bbda5ee
SHA1d4dec4505420d861dcb7c88eb364ae98c3bca405
SHA25693d0b735e33670dc65dbd47c1f00a617319fcc51e5e6481378a30a06d8d02a29
SHA5126c944c90f8b3e6199c2ddf44e551b10ae0e743f99885308a7ac9ad2b9e0078a309e019d288ef65adcdeb16b0a047aeadb0453ffec600a402dc1eb1fe7564f428