Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
17-11-2024 22:11
General
-
Target
45bc58212799b9d04d74f1d4489e1f60519f2621bb59227a193fb8cbdb142d39.apk
-
Size
1.2MB
-
MD5
e79b2e8b83d690fab4318043a209d48f
-
SHA1
95403b2457d75a4d518613ebbb72db25636f43e9
-
SHA256
45bc58212799b9d04d74f1d4489e1f60519f2621bb59227a193fb8cbdb142d39
-
SHA512
4fa3afcc791a846b51182f180ad95861662db464790eee357cb7a9a584140b869f69cfaa34c5eb6bf2629b05a607416ce488990cc0c3cfdbd84431ec7bf94374
-
SSDEEP
24576:RA3jGcCJgb/5+Csq+DI9ThT0NiLkpdrf1AEPKKxL9vAMDgSy6uQq:qFAgbotD8dT0NzrrO+7RDgSnTq
Malware Config
Extracted
hook
http://154.216.17.184
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 22 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dehodigipuhixoyi.mafuko1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5e2e6bcf2fbb8a24a8a2f4d552f4c42b3
SHA17349fe529130bf18238b67736d0d0cc2395abfb8
SHA256e5199ee2657fac2b553126552282fa4f5d88af890859cb84422dee4a94096a62
SHA512ed9d5d588de853e490349e78a80a0e78343cf6664bddabdadc6a406194cedd3917fb42f32f3cee19b6b613347b803e13ad2f2a4a28f7faaddabc96701c5b9113
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b7f03c3296011fbad6c45e0ebb7d1e27
SHA147987c185b4e38b12c9eb250a19d2f39526e6b00
SHA2564d4765716deb42abf92903fa45968602343ad7fbbffe04d93a84986a6172151c
SHA5127abdc294e3ad88d0d6424f25999d839fa283f5f71d8531baa2dca4b8f1db9938a697b94cef96b2adbafc51afa6fdd684f84961286377ef399bcc2de95ea8502d
-
Filesize
108KB
MD58dd66131281a8ac7e2298005253f9ad6
SHA143cf32d988c841122fc63fad183d8b0066a3011b
SHA25627a68313160a16042f7d4e51e410aa64ffe09d4b15276964820a8803550d5215
SHA512960b32c7f49f632b5e56f4ecfb87b3ccd825062b3b87c90322f9ae792a39d4579bdffe90042f661f68aed931d3c323571e65d7247a32e307bc201040a7736b1a
-
Filesize
173KB
MD58687e12e0ad6f0743b9c913cea8ec893
SHA13aa9ce7fc229f774cc2d499b6128be814ca2c826
SHA2560215e163c09de7d26881e9a113962876ca1d2d08ef514efb42c0fbba6c405413
SHA512154523b8b8c0e0e53dc32c993f7a140fa8def571b7a0e43e7c944b7c902bdf2bfd5e7cecdd67b551f42901897ed25e4fc33db1848ee43dfef4aead336c139221