Analysis
-
max time kernel
146s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
16-11-2024 22:03
General
-
Target
212f2a7c4e9bcc04b5b0a0ea54dee9383f6579edff0eb7bbe6b3f3f1fe612e53.apk
-
Size
1.2MB
-
MD5
7c882c3bf4c6fd529e721def4ca81b5f
-
SHA1
351a02f493aa11c01582f36898d2f0de9027b70a
-
SHA256
212f2a7c4e9bcc04b5b0a0ea54dee9383f6579edff0eb7bbe6b3f3f1fe612e53
-
SHA512
1063d945d44a93c0d9589293f316fd3659b78e2cb06dd302f384195389727c6114a156f1fa8395f5e1f3a91db7c4c28993b48d60470e2f27d0fb025d98f9fabb
-
SSDEEP
24576:X2IIF3x/VLtaGaNuLifurQBE4a+3JVdw04BDxw17g8No:LIbaGaG0SrELdnMy7g8K
Malware Config
Extracted
hook
http://154.216.20.42:80
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.TrppIrxgIUIJ.BJnPlAubukVO1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD501db41b63e2f554ce2554e7c9f42d376
SHA1f4f513590e44aa4f522bd2a9ff067c4c1152940e
SHA2568ea19ab97a13bda36dd7aa656ac2667d0b80ba2aaa09acc4139a9cfa30788108
SHA5128cfd0ce68857b726f9673bdbfc00e9c0bac266fab9ba47bca2406efc19cf26610484152eb4198216c2ec96e30d205617b298aa2bd3f16ad5c3121a1c7cd1c462
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5ef40b26d734e97c74ace52d51e0686e2
SHA17eeed0e5e4c140d402ac84eee027082589535723
SHA2569673bea1c4e3aad15db7bcbc74a1101abfca803e0e88da321bdb62c92b560eb7
SHA51210123918a00dc29ff55c01a39e2960b61449c20d9648451ead98cb6c106f7ad770052979cd70898eb851db5b3776cb3672b5987c82fbebd0edc3f6e6f4c1448e
-
Filesize
108KB
MD5baeca29e6ccb4c3a71e0169f6bd042ca
SHA18e3c439fca18aba18bbf391e023b88b6ce5629d3
SHA25678d9cf356dc178f0be25cd7fd2f5ede97b4d5b2fffa51a8f283960718d3fff5f
SHA51286ae7fdece4a316f2926d8de5d673f131981d074d15a072103b5d0a0d0be0aa728ba569581130ce57c023a2f93469fce624e8c50e557c9b41d5da1c48a9a18df
-
Filesize
173KB
MD568a0c08ab4b849067b7a301a35910b6c
SHA14c46a9ba5054965d525710907e964ec2c46facb5
SHA2563f138780b3d173ad750dc85fb37e21d93b7246f112b6597d0d28bc41474ae533
SHA512c4c2e19da68348136d9476987c308550e7798ce29f1abd2b26a8c44382ec43cf461ff7edccc1ed1e450bdeee7f821e38344647367f146574a5da605815ff346f