Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
30-11-2024 22:11
General
-
Target
fd719965666798271100e5deb15a53183ac17d73a48bf1fc93a77ba3c729edf7.apk
-
Size
4.6MB
-
MD5
2fffb38f6f4aead96f7251ea93b5b34f
-
SHA1
95006e66ee48efca678615f90eb8e10f1fa358cb
-
SHA256
fd719965666798271100e5deb15a53183ac17d73a48bf1fc93a77ba3c729edf7
-
SHA512
fdc4916b357063598e12995afd43d2740e333ab1fa22b70c077c693edc8f83d4f0f875f97ca94dcf6c36072a8e76793ccf15b1aef15d25eb64d4dbbfd0317593
-
SSDEEP
98304:rfr8z1tj55Lf3uRJfRUn+C+HXsUcV6ubGlJC0fVjtjTDScalssyBwAvbET:/8TthSJQWH8U26KGfC0fxtjo2dvs
Malware Config
Extracted
hook
http://65.109.83.248
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.fajxnfbur.emcitjnsn1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5920c5b1fce07809e44c503223198b9f1
SHA1a05aa22d19b235b38ac5976558a93418ed817444
SHA256940ac12226a55995a3f45cb0cfa11f0f5512bdcc6b59b0bb9660e54ab69b7156
SHA51276d794dc7b1646ecf0655200fa8570e3f09704637b0661f08d6d3f2a62a4984d1c55d3fbfb0f2048ebd32beaf7fa781d2c28dfe1ab777a4ba22c83be166f2ee9
-
Filesize
1.0MB
MD56c1e7fce94854d3ce646a7566abca70a
SHA160c6bd8880d010ee68f241557a989806c055f6eb
SHA2568625103449a205744181ebf38d907826d563be86fa9b2cc5867f5e83f5198a39
SHA51258d4b84c7ae3817bc8870597a3e04d65022a5ea11fbfa0e1a96142660557af0a12b8c759b018a43f858663ed9f9ffbb434f0aa455aca4dcbf5b990767848c0f1
-
Filesize
1.0MB
MD558eeabc59750c370b75432b856cf69a2
SHA1a3be61b320a613950d0fc1e74b8a6cd076aae6a4
SHA2564ed349113bed89f3b402b5679e10a07c188561d21a13336ffaae9b58eb7a8e00
SHA5121c264c69ce5d4f6ece818cc33ad704d86e765fec977cad5cd4e3025040302f7234dcc694fa33d379bb1db24c1d228d9ea4597e6c112ecf2ab004bc3d392bef64
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51fc1bef717970702991e1e89be7d263b
SHA1840f7f50e7221db81afc2cbbddb42af211aaae67
SHA256487fe2d73bc3d8b36fa78f8d72796a27f6c8724d317761b6149aebe6224d87b0
SHA512e30c0674b5ef8a9bae3955446711d6a045245474c9c6a697b0c9effbdccaa3d4dcdcd9d9705989e6ed73fba9c51a1b04edcfbf1f274618d5bca5e0e7c8336518
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD56d341991cb25759a2eb7e7e51b6792dc
SHA18ba21f9a0d8976feb32009cca5d94f1f5828f9de
SHA256c5b84267843991d69fcc18b49a8cf192e7bc18a6b8b42b8eb2f00c0f38295a5d
SHA5121aa975918e2d02a536554817f31468f6d272ef49a4fb496327c1675ba0ea1e3731372a6f7a44ae4ca57a0e41e4583781419e0011728283d1317195b078fc3dff
-
Filesize
108KB
MD5e39d33ed0626fd4d32a6b0edeec678a0
SHA1a0b077df5c0f5c56a09b9f8246c6cf07af7fae06
SHA256a1ef2a46617c8090c322f0e655a162672744ed108eea86e707695d086dfc62ef
SHA51242c8b11a595638de3d36a46eba452cbc3cd5eaf845c402459c8d069c281f39a6785ced490dc362af56eb470d876fe1a534c12d8c1ce85934573af610729e069b
-
Filesize
173KB
MD5daa4d3fb4b626796c41941a60f87976b
SHA16bde0b82208dc8f2958136c4ed94317faaf667bd
SHA25681aeb08babb378efcb0263898bd97abb298b931e1dc0639683e7230bd3aedd08
SHA512a18780a1b38edf8f7b7cd2dead72c1de09dddb014ac7464270d7c0b2d7250d8bd5512246f123e5bc02e2f5d7f3c86d75b93a0205f6d79c9052b00ddd7fae6e63