Analysis
-
max time kernel
147s -
max time network
158s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05-12-2024 22:02
General
-
Target
fd715916260b75edbfc640c0fdbd5d641953b93017168bef4f0ec77d9cf34bdd.apk
-
Size
4.5MB
-
MD5
3b4a9db4f4ad949b7974f83eb9d8ce66
-
SHA1
39a50e6b9f4c3d45a73cd3fcdce589485f013580
-
SHA256
fd715916260b75edbfc640c0fdbd5d641953b93017168bef4f0ec77d9cf34bdd
-
SHA512
f1a1a88e9387bda63f65de3381912ec078dd30e95d9543558fe5798a13e4309a6e4e09e1aa5a15351349dc3679c736968a95685c358e242764363e27f0e1a5bf
-
SSDEEP
98304:kPaNJoNG7AGdM86aSINknxdzl74QJxe3ZPHO7AFZYgBbMXQF:nbMeM8fjknxMQ23Ja2ZYEbSQF
Malware Config
Extracted
hook
http://94.141.120.34
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.udyfmmpcu.romkvoabc1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD51fa075d6a84789ede11026224fea05b4
SHA10483c0f774e120dd6b09a362520685ac968dc6d7
SHA256d64f3070235d0cc4cc39ba239fcbc542cc9a991e87a6d1261e47d1012fe706aa
SHA51202f9afb16ce2e4d1f2cf89dc67e076cb8d598f208dc26edaa14ad8b241ba40b1ad79bd5cd39c966df760aa1e8fe73d3ea0fcbae11906e82029775741867f5c70
-
Filesize
1.0MB
MD5a7ad2af4d63eaf2dcbb21682800ae15c
SHA126b6d7a28dde8bc99cca8e9502f5faf24be412e7
SHA256b4978641c5bcd33120c606b8f44c605f500fe7ca3def7ec79ba3c6ab5d1e4d59
SHA5124ca05693ba899c287af2befface20de274423ca406f619c15ebab4cf3eca1a986653e158c2af37f1edfd705d5968952676fe227ec6fa712b5fc41a8fe0c5e2ea
-
Filesize
1.0MB
MD530c08a571535168837ca595efabbfa1a
SHA16bf1bd00f8801ba9aed642e535f2d78365230bf2
SHA256e23054f13a593bb42d7cdb90b773da5befb23e0509f0f04fbfb80dd3def6debc
SHA5122fa3401efdd677723ae8cdd8a40719ca20ec140097a4d44a505c1f19587951380b1601869ddb04030d48d38f087f00b87f7bb6d490817754bf868931aeaaf055
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD55371805c4d30bd3ac11478c7ce76ed01
SHA172b6405b0ecba945b67619415628f9392a5c606a
SHA256f1744f8dada260b7a2b7c139b5c7f7262306fa5f43e79b88b54162e451fbf182
SHA512ec0518f7a4a51d8650c352f6ccc8e0a62cb03388779eee7b13ea10765b2f17a9e429da09a1f55fb6866942c92ff856fac4e9798c87fdae4944830ec5e8060c4f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5f509faab830ef4eab42a48f743c567b3
SHA1526029b8de61004e8e0276ed203e031e3a79cefd
SHA2564bcf7bdd49f7563f7cb83d58231a355f3ffb1bf18a1020a78cccb341778d1332
SHA512bd90b1dd20c4999c68e8c1745c91b62e226bd58a7ef635fedad8eea34f24204dbcc9ced46af3324bd19859ca4bb32a079f0bf4411fc1c762f00aaee2605122da
-
Filesize
108KB
MD5bc1269e831457e7af85c5f3749d207de
SHA1724dcb011d48002b2cefa6051979ad9e1fe25bc4
SHA256596373883e9ead0e615014403b63c27f1261ed71e5462f49218c14ff6440a759
SHA51273d71e93fff9ac591abdb48ff1da6185b75c3f0427b5c57c942836bfa1d65b50ff591541c48a3c5760f5ac80844e2284217be0497b1400bb60ab064dc4380fdf
-
Filesize
173KB
MD5955235c02d8d30af40a6c68127c11c4c
SHA12b05493e414d7e97bee13133321219e93b945481
SHA2563b29e12e35e3a9ce17f8171216b1af338348a41743ce85ce3da9e0041997e988
SHA512734f4557a05d21a98a7156058c7a4807e915a191cefa07a991d287fc98dd37bbb0f2e9e31ac2045b367743c2f44ef592d2980d8fd6cf17884763a53a32ea76c8