Analysis
-
max time kernel
129s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
21-12-2024 22:15
Static task
static1
Behavioral task
behavioral1
Sample
a1cb4730227e27f7d6bd7b6782a31908d885df663cd13e2899b7bda43ec846ba.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
a1cb4730227e27f7d6bd7b6782a31908d885df663cd13e2899b7bda43ec846ba.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
a1cb4730227e27f7d6bd7b6782a31908d885df663cd13e2899b7bda43ec846ba.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
a1cb4730227e27f7d6bd7b6782a31908d885df663cd13e2899b7bda43ec846ba.apk
-
Size
2.5MB
-
MD5
5d498abb0f99b3a4d57dca6ce0d5b530
-
SHA1
fd51e64ca5ac2297b8848d85f7d22f48e92c469c
-
SHA256
a1cb4730227e27f7d6bd7b6782a31908d885df663cd13e2899b7bda43ec846ba
-
SHA512
99db244a2aff14b9cafb2a19f61a5550f4fb1a95f601bcb6f40dd4cda2f6ace7fd75fa7b328995a1927abf014bcbb46d955d3e1c7043726552dd0a0ff7429565
-
SSDEEP
49152:mbPtn/srg71IMYSXwf1OhtkBeFpj6FnB8ZZK/l0fdjtkxGk:mbPtn/JO+K1OfpknO6l0fdjtkIk
Malware Config
Extracted
hook
http://154.216.20.102
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.pzvoxzxip.lxaqztnyy/app_dex/classes.dex 4633 com.pzvoxzxip.lxaqztnyy /data/user/0/com.pzvoxzxip.lxaqztnyy/app_dex/classes.dex 4633 com.pzvoxzxip.lxaqztnyy -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.pzvoxzxip.lxaqztnyy Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.pzvoxzxip.lxaqztnyy Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.pzvoxzxip.lxaqztnyy -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.pzvoxzxip.lxaqztnyy -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.pzvoxzxip.lxaqztnyy -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.pzvoxzxip.lxaqztnyy -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.pzvoxzxip.lxaqztnyy -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.pzvoxzxip.lxaqztnyy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.pzvoxzxip.lxaqztnyy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.pzvoxzxip.lxaqztnyy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.pzvoxzxip.lxaqztnyy android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.pzvoxzxip.lxaqztnyy -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.pzvoxzxip.lxaqztnyy -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.pzvoxzxip.lxaqztnyy -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.pzvoxzxip.lxaqztnyy -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.pzvoxzxip.lxaqztnyy -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.pzvoxzxip.lxaqztnyy -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.pzvoxzxip.lxaqztnyy
Processes
-
com.pzvoxzxip.lxaqztnyy1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4633
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5c5f2d438a38147bd5039b536bb820c61
SHA1e43c6378765fdf298ff5c01332004492f2916077
SHA25666ab822f0ca23ddb477e6e5c8e4aeed9fc18d6ea5fd17951b55930956108267e
SHA512e234916c9f9a4ed6f86f86c640734bc2ec1c620d67f69df624148d313254064c7da3b888a7919bc5723e2e782fe229b3e52da4113348d3cb99e0f8d76be49849
-
Filesize
1.0MB
MD5913964c71b809c94b494db6b94bc56ec
SHA13191a872bada4c0910aa79b27337eceb2ac06127
SHA2566f83e35e4b0b5bb8001d6d0e097b6ffae7911c36d59467206d9d589ee2a28067
SHA512f632004c155babdc6799f5b2d9ca888819d3967df2d8e629fb2a71458c5d3150e33331d8f1566c575f0d9b4e3255fb8d212da58a0b9534edcb673c70686b8fac
-
Filesize
1.0MB
MD598271965746cab6898a39acb0dbfe86d
SHA14e04abe94c3969fa52b702cecda02bba9f6bcd68
SHA2565aa8e63f609805ed76ab1778cb66a4cd4b6d7d918b9fa182b2f8651a377de41c
SHA512de0dc4384269a25430d6d12725f9d91c8a862543695f6f820424dcdebc3f0d3c4499b0884164e3b910efc779f6abe2d4656a63ab2859d8148bb747e975aff73a
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5ccfe87b09f7a8a0ba271f095cb04ab27
SHA181f19dc8f284be641dbf5972399a9df667ed4424
SHA2560d76e389afe67b57f98789768c2bb90c47f2a1d6218f38ec8ba2da0e032fb3f8
SHA5125d2dba5aeedfcd3e4b19b58ed5ec606b3561d69bea902116c93f80561498ce4f37924aff7cb2c7402928add21affcec104946267ea6273f89d0a6fca1460c48d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5823f213253cb4c51228834281fbd37c6
SHA13542d55c018e8f79961170ce8c4586b0f306af37
SHA256be2475f51f6ae3ed10d796fa3031a4f452427b83e744e7045e6c8a18feff462c
SHA51267f862080754883bede8bf7d7b6061bc07412153b3a37c1e09a36e6e36f0d5dcfb6bcc3be2fc9613e1112b9d9e64a696d93904d6bcd04db692e92f5238c38f35
-
Filesize
108KB
MD5556c179ead33fd83daaf88c78cf5c817
SHA1b4eaa7768d65090344ff6d301c277dec6ed6261f
SHA256bec865ff6aa9525578e6d2df7036111d7990e0d1fcc0ebce72fcbb03abf17809
SHA51266409cf5d0c3a1e68359db7185cafce1a4b0183d28786c4c72d54a06456db4ac8b204c5c5a34ca55d4670edd5652faacdf7b4b0e0eb46b1ea079291f9649721f
-
Filesize
173KB
MD5b690cc1cb92a2fc72065a76b6d6a23c6
SHA1d105a4420a5f52c0972014903a74c8c94778061f
SHA256cd5c6976113739add311b0537e88f979f286ce5066b1eea5859ffe37cac12b8e
SHA5128685c375e170b0c9f06317454288c39555a3e338a29bc69735ea53089ebcf857791382f368dbe98cfa83172e5908d9a14f81d3c3a4fef1635dc0e23f2eedf31f