Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    23-11-2024 22:02

General

  • Target

    29e3f0e8add22d309979a53374b05191d3eadeb2044a3f9789e69d1fd9ee1ccd.apk

  • Size

    4.6MB

  • MD5

    ce14a46d76f85e0fd89f1426424ce0e8

  • SHA1

    09dba1beae86b8ade5a3c38cbfc626c3774c331b

  • SHA256

    29e3f0e8add22d309979a53374b05191d3eadeb2044a3f9789e69d1fd9ee1ccd

  • SHA512

    4a92b66fda5c5f6553bfe2fc74fa8aa49d6469c29da5e38fd4847d0b59db8fe9d95e8ac1539b8450848477c5215813050a0f0287b5381399826ebabfe752000b

  • SSDEEP

    98304:B82CUr9okS6DlG+tPjqq16iHKjAn/dtbhLO/xpmn:e2p3SeG+tbn6iHD/dNhK/Hk

Malware Config

Extracted

Family

hook

C2

http://154.216.17.184

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ppzsqekzh.lqmrttevu
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4763

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ppzsqekzh.lqmrttevu/app_dex/classes.dex

    Filesize

    2.9MB

    MD5

    b747bc1877405e323411437c291f36bf

    SHA1

    fc04e788deeb43cba31df5957d67ce6ac6d70f17

    SHA256

    793a1287a1ab1d148ba128a956c841544ce2a1767662c75cd6e2b1768b79a9f0

    SHA512

    51824b5b1dd7147039969f6e4eb12c4776543b48024ecb6361d49ab18166016a2623b22948e223d44bd678149f37c0512186a603987b79ae5a6a88939ddfc8b0

  • /data/data/com.ppzsqekzh.lqmrttevu/cache/classes.dex

    Filesize

    1.0MB

    MD5

    378000e5f02033a121440909aedae5bb

    SHA1

    8f27f72a7e328068e957f89f5bdd84125cfdecb9

    SHA256

    ad389952480c57dc94b79518cbe1ae80e1d842d2554fa50fc2d9a77c5b7d745d

    SHA512

    d8125d653bee90d49f4db6c9f76632f96acbd90db454ac00f62bcb815e0534c6089bea380c604a73664e40d29f1e063e97c1f91396841d36c9e2c8f3f051e23f

  • /data/data/com.ppzsqekzh.lqmrttevu/cache/classes.zip

    Filesize

    1.0MB

    MD5

    0d5b4207363e49f92970964b62d958cd

    SHA1

    3822c058342952ba2e6d487e97bd34ae019aed53

    SHA256

    cdfdf0fcf2a8c7d21a6d745f573e82816c16a8a53b8b46be6d20de615707a07d

    SHA512

    97c4989ddd30fc018921953845e2e7c0568f176ef1bb766a0fd0a908f89873c3da99b55460b45c399c8e778b2c3824fd2a056c51f94b333d54961ac0909878d0

  • /data/data/com.ppzsqekzh.lqmrttevu/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.ppzsqekzh.lqmrttevu/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    fa93ab6a67bb6527017be4e5b5355366

    SHA1

    f07c050e9d918bf9560e69917fba130de13cd724

    SHA256

    b3be38edc44aa20f0b911185298e16b914427c7f8bd526fa6f6de858f9ff7555

    SHA512

    e5baa7b1983e64aa3a43d81695401676d199974529d8644936f2da3c3bde0ba130ae445871c747eeb119ab2b89fd0bd282c70834975ae056241df6181959fd99

  • /data/data/com.ppzsqekzh.lqmrttevu/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.ppzsqekzh.lqmrttevu/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    dec722fa647148c381edf06b8167a906

    SHA1

    6b838fda15cf0e40d07743d4334f0d4b3641230e

    SHA256

    e8055d122bc2269bf924c1a7ab231cbd9eceb4c24e982e72dc6a6ff5784ef585

    SHA512

    c103912b21da8e78e7eaef7124d686aa68de65a58a1a439aa5c5531eb4918acf14f41e752ddbc7ce5cba252055e2535cb5ccba4e4b8a857cb51bfcaebb5049b4

  • /data/data/com.ppzsqekzh.lqmrttevu/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    e36e8fa6f4ac41d74ee58477fb3f03f4

    SHA1

    9cb073d3e001efb4e944f804d3aec1fcd01de462

    SHA256

    7d147a1895cc88eff1450563b970bfdd0ca06ad9d59f143440526323bc94f447

    SHA512

    47b92d447ca57ccb4cb5dd37a6ea07993c485f9f9e9e54f9d7dd5047e4541fd6c3015952f8c26441ed52040d08c1a05df8b97fffcd622d6faf7ed956c31922a8

  • /data/data/com.ppzsqekzh.lqmrttevu/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    ca6af4bc6e25cabab5406a871617f1b0

    SHA1

    db439b7998f41045c95024b50eefbe8bb1699568

    SHA256

    533fa4699a789191c4b138d49d57907b10a28b119b3af76143eb634e66b205ac

    SHA512

    5d4907ad610284eddfac02fcfd4dbdc96d88f4b8788d34d7db14c19c261d9f7e573146b70471308881f91737b1454c4aeeba24589670136fe2c8e62479cac90f