Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    24-11-2024 22:12

General

  • Target

    5cb0139646f702fd0eea35b543682f9f5b7f8b74154c8696171f0aaae98c5d80.apk

  • Size

    4.6MB

  • MD5

    d54c87f71b32f4736cdc157a69572d30

  • SHA1

    d62e2553ff0d06e37711405979ac6166e54956d1

  • SHA256

    5cb0139646f702fd0eea35b543682f9f5b7f8b74154c8696171f0aaae98c5d80

  • SHA512

    87542cd0e32e74f2399ef0105f8825434feffb30372cc4603a7fae155829c95561c5d91e24cd71414822e2fc14e91787beef82cea500d7f9ecf97f0628580271

  • SSDEEP

    98304:p2j0TxTTfwqb9yxP81qglgH6oYTjYxlVuC1OL68eWwFFhepTFwCh:WyLuP81qhhOkFITFwCh

Malware Config

Extracted

Family

hook

C2

http://154.216.17.184

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yjxvhulqf.wobznkpnl
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4756

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yjxvhulqf.wobznkpnl/app_dex/classes.dex

    Filesize

    2.9MB

    MD5

    5e06a2f8f33252d54a5a765996b88e35

    SHA1

    ec9fc8688329743bc58ac907547c9480ab669546

    SHA256

    8397350efa4b637869a7cc8195ab66ce9b23b4701cc2eea984f2f63d8d5f6bdd

    SHA512

    f875fba2219cc73380c4c73947e002b30ead89f26b07cc8ef4af054ed0bcc3fbeb435c2b15919f1351963e674661345422a0c38a4b9ddb9f2f6c01b4bd4fdb3c

  • /data/data/com.yjxvhulqf.wobznkpnl/cache/classes.dex

    Filesize

    1.0MB

    MD5

    30fc69aa0057114389f815fc73f88d23

    SHA1

    625c83a18065fc9cc4232fdbbc6d0903d29edfd9

    SHA256

    3b5802797800d7cc601499bc784ed4bb99a761b71c46c80369fbd69e72557ae3

    SHA512

    c13fcab948b06d205e254ceea4e68126507b63413b6378d6858ca575e6343a4c682111d29ecab7b6bf38a67c3b8a40321177696cdec3e82d618a2848e13bd991

  • /data/data/com.yjxvhulqf.wobznkpnl/cache/classes.zip

    Filesize

    1.0MB

    MD5

    e493a8ce0e2b4d03676b00747ab50003

    SHA1

    84c5dfb64335ce7a92cea0036fe514eebb16522f

    SHA256

    2dd711cbfefc446dbdf770099fb7399e5b2609b805a842b48d029b89d16e1d72

    SHA512

    b489777b48533ccea303e79c9e40747bfc490b9f4033a2338c348e2d16655d222d260ea75f8e6af6d9807fd401b44573152925237661109d25f760c9db05c371

  • /data/data/com.yjxvhulqf.wobznkpnl/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.yjxvhulqf.wobznkpnl/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    a68f4999ae68d0b55b19a606c8594293

    SHA1

    9a64f57ed0db8e1e3d05e33f91e4a3ec90e912cd

    SHA256

    be1b808d6f572650317f4db7e79548c60d85c87995f9aebd50f33c5eed436f80

    SHA512

    55f31eacbf1ea052213ef423eb7b85f55809bad8081b5307f59c1731c0de1c459b8342a9e3a3a258749df9afc14ab317e4c1598568811c986d647762d9f7d75f

  • /data/data/com.yjxvhulqf.wobznkpnl/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.yjxvhulqf.wobznkpnl/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    a88842ff8b5a9bc5d3470ca5c7ab2762

    SHA1

    bf5b461daf8b13eda970a107933134f691731e8a

    SHA256

    d09b306c11e78e47c7946c09a685fde49b302df249e9aadb9ee5da0777b836ef

    SHA512

    382caa62877d2cad0eb1c83e5c0e3c1afd35588b823c2520884753c84975c7609a80c542712403a5f8837e18e45fd9866d904cdeebe990be017bb2abb59217e9

  • /data/data/com.yjxvhulqf.wobznkpnl/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    87e7a96dec8b91d830e7020b8329c420

    SHA1

    78371ec42a05f5f212c5553df8cfe7ad6fd8f867

    SHA256

    ec9f32f8f54206bf168862a256f02eb1777a4a6e1761ed66e8ea4ed1d77ce25b

    SHA512

    c2bc3cde21274d690ae352454d111d75b05d3a0dc635e80d75a75448398c7e212fe58a8a2a1e83c55ddd0989c9388b25ad0c9f8c8da941a38f4768f7ebfbf962

  • /data/data/com.yjxvhulqf.wobznkpnl/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    7bd94ec8a48100871a4505e7b3034452

    SHA1

    0bef0ae30bdd45a2ac01a311db9c8cb39ed7d4a7

    SHA256

    496cc1502beef6a62c99670d4a7fa094a5202ff4175bd078ed715ed9c28389f0

    SHA512

    7e3a2af18fa83c626a9ca71ff1f63a1d0b36edcbbf73bf49482eb3447826258a274e75c9cb5a0bf9803bb59113ac94fc4951e656fc0418462de870e01a1caeb1