Analysis
-
max time kernel
147s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
04-12-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
4b9df9cf6c17ffce15b2a46cf0ac6b2435335f23d34674e5a2e6973d0f0a3744.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
4b9df9cf6c17ffce15b2a46cf0ac6b2435335f23d34674e5a2e6973d0f0a3744.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
4b9df9cf6c17ffce15b2a46cf0ac6b2435335f23d34674e5a2e6973d0f0a3744.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
4b9df9cf6c17ffce15b2a46cf0ac6b2435335f23d34674e5a2e6973d0f0a3744.apk
-
Size
4.6MB
-
MD5
86d46ede8ce318e94d8c226403296010
-
SHA1
6dacbc12a42071a77258fc0977a741bff4050ff6
-
SHA256
4b9df9cf6c17ffce15b2a46cf0ac6b2435335f23d34674e5a2e6973d0f0a3744
-
SHA512
f92f167f24b748e56eff4903843b5783345e21bd480341d2168515706b513745e5abe4385f3f02bf23b21b2dc44dafb55140d075e3bf3efa85d81cbfde148464
-
SSDEEP
98304:8r6z7yRHjrLb+luycRm2bvNe9e2WBtmGHYmQm4HDatb6g6TVUnp:y6fCDrPZm2bVyIBQ65YDA3N
Malware Config
Extracted
hook
http://92.255.57.103
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/classes.dex 4244 com.dmhgdwaby.ehntehrvj /data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/classes.dex 4272 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/classes.dex 4244 com.dmhgdwaby.ehntehrvj -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.dmhgdwaby.ehntehrvj Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.dmhgdwaby.ehntehrvj Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.dmhgdwaby.ehntehrvj -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.dmhgdwaby.ehntehrvj -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.dmhgdwaby.ehntehrvj -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.dmhgdwaby.ehntehrvj -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.dmhgdwaby.ehntehrvj -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dmhgdwaby.ehntehrvj -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.dmhgdwaby.ehntehrvj -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.dmhgdwaby.ehntehrvj -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.dmhgdwaby.ehntehrvj -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.dmhgdwaby.ehntehrvj -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.dmhgdwaby.ehntehrvj -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.dmhgdwaby.ehntehrvj -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.dmhgdwaby.ehntehrvj
Processes
-
com.dmhgdwaby.ehntehrvj1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4244 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dmhgdwaby.ehntehrvj/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4272
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD546d88f78c226edf8c145b4f299acf3a4
SHA13b203554bcc21fa9e3a745c6f31dd96c3bd21571
SHA2561d9ee88692ea9918e89ac16b73a7e93c0b31ae283865f8cfcdfd143777a012d3
SHA512b443f27d2a4159e3829e2520136653a88c160b9c057d6d591b03b1e34da90b5cfccf55cc2ea3f2dd76cc55901a47b77917c9e380e169fa0f07969c136e376d9e
-
Filesize
1.0MB
MD5de687b18b199c2d7903e8dc44a21dfcf
SHA1279b5d0816ead79e02f7fe8695eb90c393d02db6
SHA256e3cb3c5fc4747a32e745b7e22ddf49bf3b3e0b6e51b6fcc4572411850caa73b1
SHA512075e720ec29a4d08f26f606e81a2f25ef860c09cb6bb0eb02bbadefa016da34f6588391030a77ceb9e1b3e15275a1c1d2f4bb2daf04e3119a6c1d6e88276f0a8
-
Filesize
1.0MB
MD5a220a685cf885ccb4f74783daeac89a6
SHA1d8ec9b5abfd1250a1f138e7dc8285f538f641acd
SHA256ad45c5fd419826fbe7a2d1ddf96a8d8e6eaf6723facf66f0f543620c9e9fdaf2
SHA5122110a7f76daeab5b28429057436886336c8d5b785b89f753fc0ea433b9d647789ab9960c1fbf7a8c50a6507fac66bff6d1c09d750787106cbd1577120f840dca
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD55e547b9a7df646ed6726bfdcf95bcb2c
SHA1c959531932783c1913df2da0862be91e443a453c
SHA256caa6aa46d955d6278989109b8c506bef028076187d889d6bd6b7ac69b80a3d20
SHA512f43d93cd27a137eb9bd0f1c4b7d39b809d54f5aa2125620bd1ed7db36eb4307872ef481c0728ef2597990ecbaf664210b88ef08e3b88c1ea54667e60e75b98d8
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD51fc0cd141049bdc77823449928fb0b3e
SHA1454867c9e240b92a3eddcb40ee1e2ae37fba05d7
SHA256ff9e442ef8d01ef87db90d3e37b056c69b810c6976aa4dc8d89be196ba20417f
SHA51287c816fbebded5434ced727dcf0688a45dfa2d90040b8fb0306e7c1aa8534e0d3aceab0ba35ed86b02bd529459b2a52d67a4eec802da3144318eb5e41e8ee012
-
Filesize
173KB
MD5a7eb0f80e66edb8fdac4c703147a483a
SHA1634ea35797211764efff161615085c0825536091
SHA2561c5b9e3e25608f9e8f81763bfb445ea614a946b2f822764c8ae8229241f82952
SHA5126ceda0ba257c629081e503c33a0ee62a83004dbf43560e4e6b3aaacc509083b273107717c0bd4a1ac46a91f0f5ef067b658a1e84ea520218c40d61a661ae9059
-
Filesize
16KB
MD5188e2b3e6a89ebe5690f39c89e9dda50
SHA138e13f40b924bcc1f80af44f064c2b5a4fd23900
SHA25651248b167875e804b9b69ac1bc235d9bce8014af7be8400382293dccdd8c79ef
SHA512475f9f4ab3da1a1a6737b6f32628c96353476d43f8ea8cef265c7f267db5df148fb8487b5aed5132dcd765fbe491e73c8baef49837fcae6db8c13ad0fd9e3482
-
Filesize
2.9MB
MD56c596db936b0f065c4f1becd238e6f16
SHA1b855449ef32bd6059c263d2868cc30f44fb8a63f
SHA2563d73acf2546ab6200bb8b04d6f56cd4c5f2cd067297b36bba20ea9ded4b90a4b
SHA5122b2b9c6eb9d6b43b2291772baa2cdff0040bc936d70f7e218c3b70689fb5688eee7b3535037118f9a81e3c8b333b406d08f64487b0e169eb4c6dccf23b117a7e