Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
06-12-2024 22:08
General
-
Target
5bf6e5ee66b8f0c600a7c099f66d75d79693f4f231c7929a0faf00ac5567bdd7.apk
-
Size
4.6MB
-
MD5
8453d56218e8af188361465680c11861
-
SHA1
ce1c3931222e97afc27fce135e5169ca3e35aabc
-
SHA256
5bf6e5ee66b8f0c600a7c099f66d75d79693f4f231c7929a0faf00ac5567bdd7
-
SHA512
ad569ffdace57f90da172d92906e703655d60b18c689ca7553e35586a9421cf2ced9721a0a9bc67807ba02902568feadc5d9d65df0cd0a4190b4ad0457bfce28
-
SSDEEP
98304:KCNJrnTJ1Y7cQkS2bPeEh8erk6UzXixGvDaP1UojAToiOnI+LHb07XE:NTrnTY6xDZ5k6UzXixGvi7MT2Iuo0
Malware Config
Extracted
hook
http://154.216.19.93
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 20 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ujnbvtkci.ldtxwwziz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD54a53c5d0d6a728140207b424f0f4f485
SHA10d70a59478f8e9ad047f44a398b2c82cb5d3d02f
SHA256e206aaf7f5caa1d56dcab5f9317eca51576c4799f9c41cf49e2f60dd2eeaf5d0
SHA5123b2193513d1c4703e59c7ee8322983c688f61fd1ba53cdde4380b3fd33925f1276a55cf36fc113458cfd826d7f9d653249d9a45ae082d73c41a56e7316248aeb
-
Filesize
1.0MB
MD58d69d4a4d1cf4913cf0bd8bcc6564785
SHA11330c26e6d296693d43905716ade27f4647a33ec
SHA25692ef8018946c1985952e24e10fa1153612c2f4373b0d6069b3bd8960b2c48b66
SHA5122021fa58cfd84a53584598f478af1ae03bc2307d8d7872eba139b5175fa4c8f623763013df8157116e61ff676449fe53ae889c936447558ec82d14df8a85d785
-
Filesize
1.0MB
MD56e7f2b32d24bdbc38688152b3bb30f59
SHA1094085a821097a41b493ae4f3b7c43664ff13336
SHA25644982c18dbab6bce0917f69a922506e42d310c786181fe8cf1d1ecc41fd0e427
SHA512cd40f4996e4dda437221e491c9f3c28dd28e11daeddabc12b12a115fbee6b0afb56f1ddaabf845052d1be2318da5767a11cac7a21e6b49da7896c9a2a2b60c71
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5a12dbc433162c60d3d30ab2a40e60c72
SHA11663ba6450a165b76e1140f9cb77bf46d72a88f8
SHA2563cd7168a9153a19a6f31b9fb60180676b7855f5374b369398e398607dc2beaf7
SHA512c0b6608d1394591d4d319429fd33754d4b26862c8e64143e614aae4878a320cb64e48a35a7816bdcb77ddf61fae446b6d47c8871249c5489342263c58e868dcc
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD59796aa5db9a7de59132927e55ec1ca7e
SHA1066e0ff0a27db9559c0dac45b0d1e6b4ee41427e
SHA2567c7ef59e727d3a6df0e47d8216376ce4700a8e5e521479aeba74e6b7622104da
SHA512c56754fcf0f0b532cc6009190602babc878bbcbb97a9d03840c71848b593805f3320fa2e7e70881d17d2a6b2d35e5b1269c68b2140604ed9fc5809b80e1fe15c
-
Filesize
108KB
MD5830124fff4dab9c0e212471cc1b1c12e
SHA1ea0fc625de47c317aec9296f1b29c84066415c1e
SHA2569aedd0efddc8da63e525201cedd767727b4affd22bbac062ef644e61e12813c3
SHA512107623a1e2f26f81fb9e8066c7a228687cd47f0d0dc6f6c75ddaec0a4db0dbe6726207f193310ab67016ff812a350d1a36e74ecf39bea28f9aa3159096152fe7
-
Filesize
173KB
MD5fb8a0ad16a8d637f6e5906f13272c7b0
SHA12afda8088b8270deeca6c980bd5eb629609e2e76
SHA256300d8600745f39331f0c517dca7a1aca5a67e9f20d42f0c8ea02aaa9ffeef569
SHA512c0d094969f83ca610838f44fcad83bb0c073912434eaff4b906f3b929e1d9ae1dfe97937b83959ffb533fd2f2d54433e9af605afbc5aa4d403b829583c8bb2f6