Analysis
-
max time kernel
149s -
max time network
155s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
18-11-2024 22:00
Behavioral task
behavioral1
Sample
2698db9817d0bd985138f41d45b064aee7fd6aaea97b65722f2a8ce0669cfdf7.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
2698db9817d0bd985138f41d45b064aee7fd6aaea97b65722f2a8ce0669cfdf7.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
2698db9817d0bd985138f41d45b064aee7fd6aaea97b65722f2a8ce0669cfdf7.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
2698db9817d0bd985138f41d45b064aee7fd6aaea97b65722f2a8ce0669cfdf7.apk
-
Size
2.2MB
-
MD5
ce872a2473125eccdd53d86a94e43722
-
SHA1
25e37cb127953d8bc52f5a6df9093467601f155d
-
SHA256
2698db9817d0bd985138f41d45b064aee7fd6aaea97b65722f2a8ce0669cfdf7
-
SHA512
88c828533e8980816e3b24895bb4753f876a60c3283d0058d984e40873c0f5c32d93ee89ddb00a3db70c7ca25cfcef346d2e035138ff588061ef265414ae6921
-
SSDEEP
24576:pfgS29cgJiRESgJiRdgJiRWLiDgJiRrgJiRPNr9Lg25jcSwxwrichTBZeUyDY7Ps:1gSscVaSVLVLVtVLpkxiZH2z
Malware Config
Extracted
hook
http://154.216.16.91:80
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkpid process 4491 com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.SCSxxgbqIoQP.YRIMbkxBGsQk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.SCSxxgbqIoQP.YRIMbkxBGsQk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkioc process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.SCSxxgbqIoQP.YRIMbkxBGsQk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.SCSxxgbqIoQP.YRIMbkxBGsQk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.SCSxxgbqIoQP.YRIMbkxBGsQk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Requests enabling of the accessibility settings. 1 IoCs
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Intent action android.settings.ACCESSIBILITY_SETTINGS com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.SCSxxgbqIoQP.YRIMbkxBGsQk -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.SCSxxgbqIoQP.YRIMbkxBGsQkdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.SCSxxgbqIoQP.YRIMbkxBGsQk
Processes
-
com.SCSxxgbqIoQP.YRIMbkxBGsQk1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4491
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5aa09560d17975aed84b8f925f8d0aa3e
SHA1f2ab6099ecaa8a6596f9f0178aaa1cbc6da43f37
SHA256602e55b3e18854bf12a4eb313badbb05614386ff60f38acb0fdf53076d53c396
SHA5126184ffb7a5707b8bf521309281e89c1a1f60d602d9335ea2c68852f7a4b1f9e8ee319a136a5dd9504bfe2eac34731e7099912ee500010e810989194ae8fd3697
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b138c678eef659e79cd5d0e430a4c2da
SHA14c4d4304b32ea13b5a8a49c1d3be73143c50acda
SHA2567140aa02357da3bd1ff14aabda5d119278d76d7d265f16f48f2e824ece93972a
SHA5127543bafb8b0e921618123be8e75d0b630c3df28680609d86a4eda126bf87c95aa20d6321b0270337899ce9eaf035e314f88cbf02b63a17885c948873acc93be7
-
Filesize
108KB
MD51b7db416997f23dfc5dbd19d90d4ce49
SHA1dd183b4b2c9c6c5eb99fac78cea072661fa4c398
SHA256df32c4e22cb1b7497a9210421d34e6ff0dab50e42cefc16429edba9605850e6a
SHA5122aec1fe0a1056530f950133b585b186605d239cee1040f69d01e03620adfb136027a7adcecdf67dd877b7af6ce58ab1bde6bd2f7f890e8eb639c0e6f75e8a0d7
-
Filesize
173KB
MD5e6fd87cee8971f1b87aa9770155afe76
SHA1fcc886acdeec91a7310b7c8c608501a866b7891f
SHA25618335a2808bca88e686134a4927df0f6c67d37a199d3c3d3175e2c5f5894a994
SHA512b74f47061cd1696521fbf2e4b849f6e0a79bf092c65a2e598b5ce761d6e8f1c96888e6001cc7e2687fd6f59952a4c6fb5c2dce5638f98c93276ec689827d0f44