Analysis
-
max time kernel
147s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
22-11-2024 22:04
Static task
static1
Behavioral task
behavioral1
Sample
609eb001b2ef877d2d75446b0382321ec8aa4c2cea9d7cbddde479962687ad76.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
609eb001b2ef877d2d75446b0382321ec8aa4c2cea9d7cbddde479962687ad76.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
609eb001b2ef877d2d75446b0382321ec8aa4c2cea9d7cbddde479962687ad76.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
609eb001b2ef877d2d75446b0382321ec8aa4c2cea9d7cbddde479962687ad76.apk
-
Size
4.6MB
-
MD5
2857b4fb409629ae5f161c96470d58ba
-
SHA1
282a482d799d792cb2df8002f27a4e6c5029a85f
-
SHA256
609eb001b2ef877d2d75446b0382321ec8aa4c2cea9d7cbddde479962687ad76
-
SHA512
a2756c95f20bfea7d067fae37a20b68732b8d39f29e7051c96bf45168073b8009ddd58720dcc46d4e3c98b57a9c2524e3bd9ac6f7988f98b32fa237557f12295
-
SSDEEP
98304:nTymrArg5a4/+P++6i4ZAWBUMkhwdi+BJFuAESn7YzhbP8Tna7E:T7rlBC+W4ZhBVkqdiQJcAhn7YVQuo
Malware Config
Extracted
hook
http://185.147.124.250
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.gbqxnvcjv.ucoujosyu/app_dex/classes.dex 4966 com.gbqxnvcjv.ucoujosyu /data/user/0/com.gbqxnvcjv.ucoujosyu/app_dex/classes.dex 4966 com.gbqxnvcjv.ucoujosyu -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.gbqxnvcjv.ucoujosyu Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.gbqxnvcjv.ucoujosyu Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.gbqxnvcjv.ucoujosyu -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.gbqxnvcjv.ucoujosyu -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.gbqxnvcjv.ucoujosyu -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.gbqxnvcjv.ucoujosyu -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.gbqxnvcjv.ucoujosyu -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.gbqxnvcjv.ucoujosyu android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.gbqxnvcjv.ucoujosyu android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.gbqxnvcjv.ucoujosyu android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.gbqxnvcjv.ucoujosyu android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.gbqxnvcjv.ucoujosyu -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.gbqxnvcjv.ucoujosyu -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.gbqxnvcjv.ucoujosyu -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.gbqxnvcjv.ucoujosyu -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.gbqxnvcjv.ucoujosyu -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.gbqxnvcjv.ucoujosyu -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.gbqxnvcjv.ucoujosyu -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.gbqxnvcjv.ucoujosyu
Processes
-
com.gbqxnvcjv.ucoujosyu1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4966
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5cd656538ea17b154ce6e5e924ce51226
SHA1c0c3e008fcfb283a1485275f3f0793a3550fcab5
SHA2561f8d6ff3ea76583a2116a0dd16dea77e7aa79bd74b6bc19f65005b5c6fb470e1
SHA512fec605c89a58dcad69be6f22f3efae9bc5c798cacb57522d26cf230ba8c1d48cb20c50d1d4226128347c842975fe689f6a662dfdf355d4b029012bf72b74cac2
-
Filesize
1.0MB
MD52eef054e2aa0d5b5b860a5aff35449b2
SHA1d80251639ab6486d83bebfa77d1590a01c265e5c
SHA25616b476cffa816758ab2cc1d5c61a13543e483bfc5cfd97589eccf9a4313f13ac
SHA51280638f11bf1ec9a31d0baa0049fb7c2ca2a38576fc6d5abe7193887f85160fd0a644c9133f9f66d7aa8d7420267cd83e845d490da0a2f753d4e226c57691c32e
-
Filesize
1.0MB
MD5556c86801ccf48bc917e38546b067308
SHA1a996c082a2b4a1785a41167ca5d418c06dd01a87
SHA256c287f01e17975b0aec265756b2ce369dbda205182b165c9ce5ffd1cceb626a26
SHA51271fa6711d665da5aa70126fa3fe78e3619fd5189b93ee9398cd452d621e60f4cdf00b358c5aa3daa8dc7d8f3ed33a9f3538730808015ffc3ba1eb941dcb1e9b5
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c1ddc7d6d1a09e802ad79dfe52b6efcf
SHA1dc156db9a7339c9b715e72d6f0370b35a6e5cc42
SHA2564234ee4a02dd29701d9368ab7f238bdb4e4a96e6bb65ba41c7a8ab57a5dfef01
SHA5124c7e22627a2472e44e3f4c00ea0b0e5b5a46a0313d4dde9d14b618a5ce32b0fbe91227d03774a1e08bbc1b14bb31008b6f246976c1827d70215791beb4c88740
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD50137a6f03d1786ad05e307218277ceb9
SHA18e8d0ea85ae6b7132585325e938d33ad8c73a29d
SHA2564e78bd0b747138a453786865e2700915294e85c7ce33fbf5329672ab46022e8e
SHA5129d1e704c532b53040dc96dd137d2c391025123263b238da0d17fd223a72901bdfdd7d64f0b6637e7a8459162407138b674936ad5ebb5b0c7a1f54f1df814624a
-
Filesize
108KB
MD5ac2fa9961fb154b3690ae190ea21bb15
SHA1bc91b57da61f4b65ef7006ccd7aab2e88b67c0d5
SHA256ba146874bbba1b7c6ea87af28f89cb98cf925d66da31a5e63b068a9e029a7700
SHA51262feda675819c90abff6aa35489ae617aedb6bf19853e007c2a4730dec8817b10dd1e6649b60fe32ea0e74e37ca8dfe106deb9475fab72e2bda0c08a4c5cc62e
-
Filesize
173KB
MD5651395bc8ac9398811ce5b8dd83b2a31
SHA1aff3e6debd74f78f94d3b4a70c84eaa06362c924
SHA256b98353ab8242a7e93995633b6d9147dc8cb8878a8e3b0a9aff89660379263524
SHA512c1633cd1b356b3935da16f1904c128849b07566009c08e722ac8915c9df8892720e7cc75aeac593abb595da8f3e6daa27c8038db047393593f3eced604b26016