Analysis
-
max time kernel
148s -
max time network
155s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
12-12-2024 22:02
General
-
Target
445c5b6c2819fc01ff7f2304d26be53f8ba9ed65203496a5d410ecc12e12ecb2.apk
-
Size
1.2MB
-
MD5
aa204b7529c147f509c71e4eb675c88c
-
SHA1
cc7dc7764c118ac0adf379b4697ca3990b869561
-
SHA256
445c5b6c2819fc01ff7f2304d26be53f8ba9ed65203496a5d410ecc12e12ecb2
-
SHA512
f5e7137c91663d43963c5d9cdcf4c397874feaddba66f8f959c4832d2a32c8cfd4ad370db146e774e41575acbd4cdf4b9fd559ee087eec9f1c39c808f0b2dff8
-
SSDEEP
24576:kYF/KJaA2KTAdzF43kYYqFUJaomHAZN1jL8pbuz6ET4NRle:kYF/WqclHAZNqpbu30ze
Malware Config
Extracted
hook
http://92.255.57.103
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dehodigipuhixoyi.mafuko1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD551ceef76008fa28ef2691d0c8b601d9b
SHA1b69151c445e2f11561481c495a1da23c86651fda
SHA25625210062f133c5019aab2ac89d1f468a3f6e1447dd2db088a046db01efff2d70
SHA512d981b77e8027b949cd47b06edc6c5999ce57008fef2fcd467b0395403bf271a263efc39cbcbd3c82d42282e8791e97474372a87775851c3f75f4004230092e0b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD56c0d23deca2b4c7409dce0b2e4e39b29
SHA1361c828d982150430eb86b9073ab95aa826b266b
SHA256664bf2a6e694ff874a07495cb02fc93d04f26c6034826c5dd2a789044bdd910f
SHA512412b2dad8ea136d6c84967a8bcefd4dadbf0f3cee68d9940f11e332ea6532f652f412f7c5ec86254b6dc589124b4af86cc9d1e73c60eb0f8228cdd9e68cc4a0b
-
Filesize
108KB
MD51484a871693fb531ec34350ea55a9d53
SHA16dedca6dd7ecd690127963c8acd9a319ac86d133
SHA256f1a189899f23a5f98e6ec155b3b5e68efe35cbf9db9375f4172168066d1ab6c1
SHA512fa08bfda0e2bd4df1ad1c91670b079e2aad44895afcc7eeb86ff554f9fece6f1230addd4b809a28dcaf714cc73d7aa366bd17baef924b14580784fc8fb9fffd6
-
Filesize
173KB
MD58f162d4b46124a383e330817d5fdbb08
SHA187bbf692fd5553e6576e945abb085e7cbecd0e72
SHA2561951a7caf4990091f83b04e53086f26af3098c73a44cd449fb0597a986cc6341
SHA5120565824dbf83f0b4778d82710abf11a81add15920aeb9716686bbe273a6688dbb3c35289397eb33f9fe50e72d76ec5d88f8f06e693cc28d108cb85d6cd04a47a