Analysis
-
max time kernel
145s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
19-12-2024 22:08
General
-
Target
f88437460f90efc63ad2be3a071a28dbcb8425dec50a2649f9bb6ea1d19a5ae7.apk
-
Size
1.1MB
-
MD5
b0bc94ef04ef85f1ee14b63e477f2907
-
SHA1
011622979676854674cc276d3e38782c4115be41
-
SHA256
f88437460f90efc63ad2be3a071a28dbcb8425dec50a2649f9bb6ea1d19a5ae7
-
SHA512
5f1d3b0e1a1bbc98257c0037079ad87998cb4c45b3452361ad975d482243008d764d7aa90cf827ce8abb52f483dc6c6d680d4ff94038a26921c8d9adc8cc054d
-
SSDEEP
24576:Be+Fh6O9HM3q8SZd0BJEyldcIQKyYFvs/ojyP5g/5eVU:Be+Fh6O9HM68Mib2I4X/XP5g/CU
Malware Config
Extracted
hook
http://31.59.114.219:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD576a3851f6cabad71c3ce940a86360fc2
SHA193d6b6ae83396cadeab26f2ca0660cee6eefbe3f
SHA256b4ed0bd651799bf5e9914b4a1ed6432c85a17294ddeaaab88c6d4fd3a5f8a5ec
SHA5125aff98028442e156b378ebc88cda302c62ec70349f429bc23386cf71d8ac53cca49f7b860c2f4fb40bd7122e3d7d1e6b5d482c76c2a76bd8049f3234eda2f3a9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5da7d90ee2af933c9c7f43e5e590568df
SHA1bbc6b2db10888e6e7212508edfbb8d6691881512
SHA256c07f9377938dd7f590f7a6f3cc78980f515cd148e81daccc9fcf5c1207bc44b3
SHA512982185e8c3ad75e994944d6946f42f5de7fa8c196090cdb95f8b9440b89de2bd8e436a365d48a87b4e4a08e523ef59d727427b6f4203e086e5c4110a2dd6435f
-
Filesize
108KB
MD52ad97385be93344567c5e002e0c8e341
SHA1aa2815f1152d208792bf51aa95b95d07149ee8fd
SHA2565ee6cc3e511298f0e6d974bb16a0d2ef745156c64839eae272d59426d8596295
SHA5123c7fa5913cc14ce80943926db9643cb4f487c9639e2977bca3ae8da4d558f46d886d55a44409c3fbbe86ff789e3eaeb6d576949ba1eeffe7c2ff334f37b96c40
-
Filesize
173KB
MD59d04479d1a797be5e3043f0792ef660d
SHA19a7c6e031aa8077a5fec1c639920255bb7f5505a
SHA25665e9554934e78440959b557953311c2b10382db30d53c9631d3704ea6c2586ee
SHA5128f6a8037abfdb1815aca02ddac4df216b0cb69571652af97d68c0ba529d032ef949cd923cb5626f0a372cb2bfbdc44d6aa55967ee690cfe2b05518b13d4b286c