Analysis
-
max time kernel
11s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
19-11-2024 22:05
General
-
Target
9f97fa9cde840c4449c73cb838e0af65fc83097eb086c359ad458716150e6c0b.apk
-
Size
3.4MB
-
MD5
b6d1931f0dd6ae1423ad26a933f7f00a
-
SHA1
468dd981c0616e33b4fc65d282e4cec3c2c107b7
-
SHA256
9f97fa9cde840c4449c73cb838e0af65fc83097eb086c359ad458716150e6c0b
-
SHA512
bb114ea2636ac383ecec21178d1a2579a123b84e0dbd28c2231a65287ff157d7ecc8992ba0fc550964b13bc5de95dbd18e61f6be23dab34917532c103c394de6
-
SSDEEP
49152:7F/aTyaG1tEcXHhoJiMcCol1zmlDxaDFhHM/HkZARR/tT/vlRVlckmI/H9aIiNsx:oTvoCJiJCA1zml0DF9UxVlRVlc8fiZX4
Malware Config
Extracted
hook
https://ws.fasoqloper.shop
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD52aeff6db1fdbea903ebd8da40abf9aed
SHA158c90654353cb3b691d202e30f8b83cb0fbf6dc6
SHA2566a59d0097a81bb0a9e56026b7c4d65caf0e788846d80fe94a772df510068f396
SHA512d59bf5dc99b2ee3a58be3a89e6a6e17b12506d1a087eaf859bc31b95f5d0b648b4dc70df6225ab91544d7f82ed57a17ea30c6e0e56cce571ca58fd835b37dfd9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD596e9a5de5864ee1d7b32f6d23bdf25e0
SHA15c707f43a9024558dd7fab62d66a6482691a44cd
SHA25635402538404438091f6db5c3246973c9e5cb50a5c62d7cee93d556ba36d7cc5c
SHA51286a64d07c3d59008e02b0b6dd64283297f028d533a55dc89a7008936cf294ccc0cd231968ada615b85fe7b14db18638eace37f3fa85248814bcadc7ab2c31c6d
-
Filesize
108KB
MD57efc50a0acab764a92ca1224d21e70ce
SHA1ff462e01e676b3f4d75aaeae04b9f9b61b1ef445
SHA2563ec9d0dd89098b1b795e766d00bed1d4d5a64fff7dce7f2c9f2f9955a928b9e3
SHA512fbbf34bb8580b5226bbae604c74d7aa37c35fd595d6535d76b7b0a784e4cc413aaf0d1a96a967c861d4dbae87e68ce4572486bed2acf469f14e3e356ead53090
-
Filesize
173KB
MD5bb59bc0435d99f12823569076861690a
SHA1ac8713104248244abf5f5915580b57925d042a5f
SHA2567b4d171be4155ab11674cf9d284b94a196e066d57720e08184a68ec99157cab7
SHA512a1f6d7780cd5d0d6ef1506f45111d31c10be34ec69b31cde3b961b8f4efef33a822099c5e2676b57cf2c0c24d39e68befac80a4f86ce1b28ba43b7448a9c756b