Analysis
-
max time kernel
147s -
max time network
154s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
14-11-2024 22:00
General
-
Target
af9a6cd0c47ff35f8c1c64bfc1ec90161489d54d5eeb56b15633e2ac31726fee.apk
-
Size
1.2MB
-
MD5
d1a5ba4e82b4739f23cd397634000ada
-
SHA1
97eae7ef29a4ed24deb5b920f66a3c97a182d4db
-
SHA256
af9a6cd0c47ff35f8c1c64bfc1ec90161489d54d5eeb56b15633e2ac31726fee
-
SHA512
b7f4120acd546dcb5d215f24ef864e2dc1c160af37a5c6c802a20ed9c8c926a14621bf8774d10ed1e1e81ace83383d752e8c02314e46aa2f51c2f1e6249ed664
-
SSDEEP
24576:1/YA9pYzy+US3rxP7azc8Y1vfIasuOUPZ/LTX7g8zc:WANq8zcJ1HIuPZ/Lr7g8w
Malware Config
Extracted
hook
http://154.216.20.42:80
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.oSBEpqqbkAoQ.PlxDvcPgfkiW1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50540fef2ccbdcd9c3c8e2914c63e9203
SHA1d3398a0a2452aaca4e8016ed0ab0b82110734ef6
SHA2560eef17bc2af6e0c6aed9f03345f9355c8aab325fbd4c875d0fee0a8ee5dc924a
SHA512aba402472156571bd016a8a4256720fd3c28a7440a9e1145d157d72ec013d3337be681890d73992071a661c4ec20b698e12c8737907c35adbbf495c03abf029b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5f5dfb31b8fa4dc81d79ed0c5ffe507fd
SHA1b731bd3c36f905529d2888e52dd62b29ae9c7c91
SHA256c9cc662c97bcd80e8338802ad3bf86587ee2f38f6d1db2369ee5d936b36ececc
SHA5123853d07d4df948bec81fa912e5b6b695be40ed306c5b666c33ceb3f7ef7493a1842a7a49da9c37cf2b39e13af7a092a69877d7f314f1a072ca5a0af6137673e5
-
Filesize
108KB
MD5a83c3d8dd772ec011546b63e38cee227
SHA1dc1d1909fbcb49b68cd54a215ecb45b614cb530f
SHA2560ae4baba655224b680342eb76c992b684cb4ea20a4756861ebce0cd269f23a0f
SHA512a82d03f4860d521c3001b9fd24c314dad350b431147f531a2988d030eaaf2b7d0978d09629390613eb1e03285ef555c0599229934923f254512354cca7d391a8
-
Filesize
173KB
MD570bd13511a64afe87dbea0dcaf36ecd5
SHA1f6a19fb55bf83afd524f6c699de2808e87a1f52f
SHA256686bd15f3fd9a27a29aabbc102b9c8beafaf221c5d7a76a12e06802c5c86d833
SHA512ad21bda52396dc3a83025b77763c2301ce40d4f53e3ab8fba65405e04e3c8cdf99736662686d038f778d072068aaa843e1cf8b9a215ca39c13d51e4e59689957