Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
17/12/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
18209e2ed12689cdfe0caf5bc69eead832d1c260c4c99728ab3eed8773d9e091.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
18209e2ed12689cdfe0caf5bc69eead832d1c260c4c99728ab3eed8773d9e091.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
18209e2ed12689cdfe0caf5bc69eead832d1c260c4c99728ab3eed8773d9e091.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
18209e2ed12689cdfe0caf5bc69eead832d1c260c4c99728ab3eed8773d9e091.apk
-
Size
2.5MB
-
MD5
073467f9db10ad237d948f8e671fa291
-
SHA1
301ddcf02063d96e0ed108c36c8e0308b5d72b8c
-
SHA256
18209e2ed12689cdfe0caf5bc69eead832d1c260c4c99728ab3eed8773d9e091
-
SHA512
ced4de73838ae1d4b04ae6a3e0cdc27dbeeeb32fea3a7a7da2ca5866e013fad055037272816338d3d00245583fd04a775e694182e177dcca27a56985ea511a37
-
SSDEEP
49152:JtK9NUrgg4qhHGpfeVQ9y2GPHtIC3eDRMbiQcU39dL7l/zWl:JEKR0pfeq9/C+weD+tHL7l+
Malware Config
Extracted
hook
http://154.216.20.102
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/classes.dex 4311 com.epaxlsgbr.dbpiiqbqz /data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/classes.dex 4337 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/classes.dex 4311 com.epaxlsgbr.dbpiiqbqz -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.epaxlsgbr.dbpiiqbqz Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.epaxlsgbr.dbpiiqbqz Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.epaxlsgbr.dbpiiqbqz -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.epaxlsgbr.dbpiiqbqz -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.epaxlsgbr.dbpiiqbqz -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.epaxlsgbr.dbpiiqbqz -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.epaxlsgbr.dbpiiqbqz -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.epaxlsgbr.dbpiiqbqz -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.epaxlsgbr.dbpiiqbqz -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.epaxlsgbr.dbpiiqbqz -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.epaxlsgbr.dbpiiqbqz -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.epaxlsgbr.dbpiiqbqz -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.epaxlsgbr.dbpiiqbqz -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.epaxlsgbr.dbpiiqbqz -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.epaxlsgbr.dbpiiqbqz
Processes
-
com.epaxlsgbr.dbpiiqbqz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4311 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.epaxlsgbr.dbpiiqbqz/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4337
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5156efaa0656d97258862de885fc860b4
SHA18dea4d6e1ab8a2ff6c0335364ce57d1c4599bc56
SHA25678885a17420c20d122863509d89914e591611b99a312348feefdd9795c31bc69
SHA5128552e73f678314bb1f13524e1c5e040bddfacf81c5230b53677cec3aec64677abf958fb5a982e5c144728eaa56d11cc0501326f160d7126d6f053cdc2b3757a9
-
Filesize
1.0MB
MD5fbaa4aa67f09f8b99c7bf08eb1280f6a
SHA1da963c27cb851c3d6f99d3e3a7eaa13dc1f7cb05
SHA2567b7b1b5cabb863d0c4122ba8ff23ac2d165e0613ab31e75dcd39ef53d9f353f3
SHA5120f7592e3e1fbb8bc70cbf0fa483a186a508125bbd0afa2645c2de607227e1dca813699fb66ad730a15f3baf57e2041430fa954c657ee9721c3734a93ed22c746
-
Filesize
1.0MB
MD5277acb9778a712320c2b655c731a7cfb
SHA1777466164a773448e6e387492d9379196cd0e8f9
SHA25621c3bd41ac971c107b5c336ecc6d3c1ea27a5dfd06c01da65df9285121a8f734
SHA5128c9a43e1b9da5acacbb5846727b8cfa081b7d849214c3d9e08916c189f0e7aade531e2ab957b4ece9724646d9bda55874a06302173a30bf97b8d1167e381da55
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD515a348fd01e1b1cb8ae239ad11b97af1
SHA1dd5c9cf8d1570a95c135293b9b1fd1848d515251
SHA2563d295da44715fd180c4a00154368fd4317c069edb2ab693d68080a29ac3966e9
SHA5125ada2d5e76be977b568b5e84c5286ee95e21968fee5c5acc6f4b9fdca65830b06215f235bdcbda4fba8ea88ba6b584385e2dcec6340bb6fffdf2da8dae65da9f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD5f6b57adea3b9413cb63303998ac86496
SHA1c4eb985809a79ba71c133323d298d8fb33f40191
SHA2560a4e0c9caf5ea0f74fd24bdd0ac5890ada19b627c23a9fedd2ec7832aa4c6ce1
SHA51293230f2b5a8c9fc228e488db899a834671088170b0de267b430669c39a7371a6138c8b68a073d0e5a95aff5154c4a1bc254a614693ead52fad571c4e6583f45f
-
Filesize
173KB
MD5c8f04d777276559c554d1747953c78e8
SHA19f7bc751faabc938998ec2d7a3f886c5d1d0ea1b
SHA256758d6ddaf6676842a224f909521850dc786d02cdd9358697080edbc2de324192
SHA51264cba61db22b8636d1b33e0725fc93ca10cdd42bcb6fd448bba0d01ce3a463beeeb6d654cd29f79ee63291019d20d038095184ddd2e7588b231fc159048ee38d
-
Filesize
16KB
MD5b43a92eb453cc13dcffce9f01d7bf987
SHA183ddba54eb314ad0ec5b764375e2ef9534123324
SHA2562574710586102be9820e535086e104bc0830f6536790401776bae599e3968cb9
SHA5129f290c71340d4a84e15c85fd4483f9509ff623d580bb3cfeb94848a468e6fd0d1d264495f8db4087ec77974fca98be6a71a2400ea40e15dbc11c756f5d280734
-
Filesize
2.9MB
MD50257aa2a922a6e220cc84be976d2cac5
SHA1585dc50717715301923fa747a7d28b6ab3c783f7
SHA2563558e827df0c549d9a9777a61d23957389f74208ce71779235dde2150f0753a4
SHA512a0958ee1620df5fc612d311191b20adba965bcd4ad80ec7a9f2a6c4d58af6384a0022203b44e06fd494bc6a7f850f8fa7ba21f71f3c0b28653105575117fe856