Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
06-12-2024 22:08
General
-
Target
5bf6e5ee66b8f0c600a7c099f66d75d79693f4f231c7929a0faf00ac5567bdd7.apk
-
Size
4.6MB
-
MD5
8453d56218e8af188361465680c11861
-
SHA1
ce1c3931222e97afc27fce135e5169ca3e35aabc
-
SHA256
5bf6e5ee66b8f0c600a7c099f66d75d79693f4f231c7929a0faf00ac5567bdd7
-
SHA512
ad569ffdace57f90da172d92906e703655d60b18c689ca7553e35586a9421cf2ced9721a0a9bc67807ba02902568feadc5d9d65df0cd0a4190b4ad0457bfce28
-
SSDEEP
98304:KCNJrnTJ1Y7cQkS2bPeEh8erk6UzXixGvDaP1UojAToiOnI+LHb07XE:NTrnTY6xDZ5k6UzXixGvi7MT2Iuo0
Malware Config
Extracted
hook
http://154.216.19.93
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ujnbvtkci.ldtxwwziz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD54a53c5d0d6a728140207b424f0f4f485
SHA10d70a59478f8e9ad047f44a398b2c82cb5d3d02f
SHA256e206aaf7f5caa1d56dcab5f9317eca51576c4799f9c41cf49e2f60dd2eeaf5d0
SHA5123b2193513d1c4703e59c7ee8322983c688f61fd1ba53cdde4380b3fd33925f1276a55cf36fc113458cfd826d7f9d653249d9a45ae082d73c41a56e7316248aeb
-
Filesize
1.0MB
MD58d69d4a4d1cf4913cf0bd8bcc6564785
SHA11330c26e6d296693d43905716ade27f4647a33ec
SHA25692ef8018946c1985952e24e10fa1153612c2f4373b0d6069b3bd8960b2c48b66
SHA5122021fa58cfd84a53584598f478af1ae03bc2307d8d7872eba139b5175fa4c8f623763013df8157116e61ff676449fe53ae889c936447558ec82d14df8a85d785
-
Filesize
1.0MB
MD56e7f2b32d24bdbc38688152b3bb30f59
SHA1094085a821097a41b493ae4f3b7c43664ff13336
SHA25644982c18dbab6bce0917f69a922506e42d310c786181fe8cf1d1ecc41fd0e427
SHA512cd40f4996e4dda437221e491c9f3c28dd28e11daeddabc12b12a115fbee6b0afb56f1ddaabf845052d1be2318da5767a11cac7a21e6b49da7896c9a2a2b60c71
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5d1452d6a45bb732f2374be05ae099fa7
SHA18421d295a1933ecf8b698206a2456d908673b2e5
SHA2562978f503eb70efa79bc78ddebf11bf49f514a546653c68d0501d9bc00fab6ef9
SHA5129bd28e86a4d1c23a20b252d770124263cdf89ca83adfb958e455aa305f9f5ec07b8a070f20cd270bc3b69341bcab094f87f4c4cd9c8b19353eaa24ca16df4842
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b6206312483dae392cb72f7a27a58812
SHA1491be6a5435e79f1381d96802770817486194492
SHA256b72e7835a4a38848058f135e063688ba1e35ad472397fb5be506663f0a317406
SHA51222d4bf3a0cbb720066b79d2ec0df531cf0e081142dc8926688ed795a621fc2013a64833c7ab34a5cf32d8dc4023c7895265f53312331cbb927e66de2564ecee6
-
Filesize
108KB
MD5dca1bf2cd2b8da3b264b48cad60849bb
SHA1d33f00888b0e29eee108bcef3c514fbccb4d8fea
SHA25699fa51bcfd1fd0d01fd950b6069a83b3a312e7ec7f656c34fb14cd7c13d71d73
SHA512d15daf6791cfc25b48762ff1591c68ba7b256e4634c45990ac7dc76c2f54863c38954fda08a080153e285aeae2defd246a5e47b8fefcc71ed33c52fc4180b3bc
-
Filesize
173KB
MD5838ec550588f97aa05c15557f38dfee7
SHA17a375be4e049bbfeda17d673962416f97e2394e3
SHA2561b1c1e63a05870c66595ebb82d0b3acd8337791088e0e79f14a4e03bb97e2f32
SHA512344faf09b7c4bc600818eb9892b45d425fe0184b08f97d7dfcadcba401b9422bbdb4f1fd0df754603ee6aaed8eb1ca3c281fec99efa7cefa70ca795d262c8aa9