Analysis
-
max time kernel
91s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
23-11-2024 22:03
General
-
Target
0334eb6d20407d9903e19c104628b1aba4af3c5bb72e192cbe6424986cffd44c.apk
-
Size
1.1MB
-
MD5
4cb6d1f1b304aadfd4897eccf96535b4
-
SHA1
85b67b27ada72289e59fd8322305177e6342a11b
-
SHA256
0334eb6d20407d9903e19c104628b1aba4af3c5bb72e192cbe6424986cffd44c
-
SHA512
85990fa362f37b1475ed671ab48495c8d449095152a95e3fc16b19bbfb165953078c3fd05aaf95bc14af86a8b3e61e4af79060406af41935dafcf44a8f614505
-
SSDEEP
24576:28PLoyj5sSdBibNqNkAHWVCiU9TQk1PIojnbmpg/y3Bg:bPF7EAqIB+Sbmpg/Gg
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.luwepocodibe.sama1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD500de024708600ea20c20390cda5f7c36
SHA1b710d4cd664d218df75beabc4a0125a6f3a7e654
SHA2561cb80f3e16f3088923c5e1ae20ea5e3e6f90216946d9a6b835e751c9df61b4c1
SHA5126fecf65fd0fb46a4a18e9a3048e6328f6bd47ac442752d495d0a341aefffe5f64316914e692b2d24e9f5036b35d95aebb5b89c2b238a8d9222dbb1599bdde5bc
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD52db08b146234c181b27e4797ad253f9b
SHA16747156c90004fb7302877aa26df663422160949
SHA256006abfb1e40321c48476998369e942f5a6214a9ab8c956c92139b154c2fca486
SHA512918083ead1eb6fe2b5dab7ee6e30294ed8092570d759df22656f864716f42cc263036aff76b5b9bd08e2e1012e7093270d6f8f8b519db16ef63966e504d3691c
-
Filesize
108KB
MD54745ef28efea694f4d27e36223b36528
SHA15c0d4d5164809ae1f3a00bfe91a0287fed3391d4
SHA25681f4a1c2278e19be7e6fa0ec622b03d45047c207440904e379e21d345d5ed315
SHA512b88829df6ddc9fe467067db435b86e9ad7c4e0f8fc94fac5f5eff60c04ccf1b186b9f14919ee30faa68be3f3edd6db8e784cb24e9725366f564b5be245d177e3
-
Filesize
173KB
MD513ffda9868129f2ec60f4d89c899304d
SHA10f8d5fc538b85f685a6ba620ca4fd200a511d0ed
SHA25672199d4eb220998e6845bdb6e63d6b0db0605d9ad1acfd591908d6ef39016b09
SHA512e55c60f8eac4dc59f16565f2b9d89680efbef883aad57e8894935b914aa0c66307455d369166616aa17e5d78a442da339ae32cad295dea7883b149313dbb85e5