Analysis
-
max time kernel
148s -
max time network
156s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
16-11-2024 22:06
General
-
Target
541ed806b91d2985db89e2ec799bde12755494d54ac80b5b066f251ccb42f1ac.apk
-
Size
1.2MB
-
MD5
a4e2e55da46aae8aec12d4bae3ce0fb1
-
SHA1
3c6db5b4f467543f2a339e2e1b9c30d2f1613726
-
SHA256
541ed806b91d2985db89e2ec799bde12755494d54ac80b5b066f251ccb42f1ac
-
SHA512
0e4d25d8a831048b956c668b2b2a2f39e0b1c6e2ef42a94dab4f23d72402b8d497cdf8c247cf5ab99f0bfe8b32b4db280e674578daae59c7541a3824e2dab154
-
SSDEEP
24576:QrYgQlTFT56In4X+Tp0eD+uc85ggUHv+CJBX7g8Mk:Qr1Qy+TpPECggU2CJ97g8h
Malware Config
Extracted
hook
http://154.216.20.42:80
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.YsZlyREQNaLG.zatoNMQeHFSP1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD504f25cb9753196313f7e5ed457bf2faa
SHA12ecff3ec873736dce193136f9304910a9a1e9a54
SHA25652ee016f079f0a4b389e7128875bb437de73fe8172367c9795a1acc84eab6cb0
SHA51200ffb8c4f81fd4d9aa8c08f581b1a055794cd58fe0ee3747d7a1da5a04e44c4101a0e81943fedbcad5c3f1359da896257caff802a54d564f780186c618bc45cb
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD55966570a826e67232f5ce4b5e079546b
SHA18e6d6afc1083e741f1046ce82af17a11758473f9
SHA2568548c21afe04bce8f98c8ce81c9753ba986e8134f82e41e19a7091de05c430dc
SHA51242e8032c328e91da7528f1455f1d4369e183f3fa8dc5c3f04063f15dca8bc5a20c94a4c64907b9f4ed1af5a7868b55a71cb0c5bce0a6031de1e64aead10f87ac
-
Filesize
108KB
MD5c88f882aa403aabec08ea0952b258a01
SHA1b7e3954698a420ded313603714676afa97459234
SHA256fcf802894170d3ca616370be959d1d3d94312dc7dc04e0eed356725512aa10a3
SHA5122f2a3221e39848f768ea7379e99ba6a14e39892a260a397ccd3c6d264e1d70a5e72d7bd04eac9145c088c8d73ec48d83d51aa070c7c5eb214acf41b769de94db
-
Filesize
173KB
MD5d3a6f98192350ddbae957aa898a12a99
SHA1712e5fb6a6a6741b224f559eb42b221c731fb1b7
SHA256e083bf336ef064d4d1142a16f7c60c6484c52cb9f7e8ca8868faceb131ae9ee3
SHA512b6aa12bc5faf2ad2afa72047a912e968d789cd2afa6830de41ac36dea0f2e791dcc00fa8860cc7c331f702dbcb7facc93460731c8eaaafc1a3c0803fb5d5d799