Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    24-12-2024 22:05

General

  • Target

    3d09cdd6bafd224006b7b5ec73a9b38b03e35eef35d9235787726b6ec6dd24c8.apk

  • Size

    4.2MB

  • MD5

    b18f2b90588de368b8523615a4fa6e1b

  • SHA1

    46fafc31aa31ed17b3e309b45cee378403aa7105

  • SHA256

    3d09cdd6bafd224006b7b5ec73a9b38b03e35eef35d9235787726b6ec6dd24c8

  • SHA512

    37df3b3bd92020bef611968a8bd19fff96de07f18f6b8a4a2195b59924db0a6a8733bb79912419907f7c32450dbab76ae8755fe6314d471bb1556ce95728fc0a

  • SSDEEP

    98304:PUAC9g3yqlp/QFldx2HQj5j3B8uRRz206906:cv6CqG0HQdjxKb66

Malware Config

Extracted

Family

hook

C2

http://193.143.1.24

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.maxqenmnh.xvjrjhanq
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5159

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.maxqenmnh.xvjrjhanq/app_dex/classes.dex

    Filesize

    2.9MB

    MD5

    3b3a6c6d45f3ea0a7e52a9335ffad291

    SHA1

    d5b5ecee628e8ac160654703893338f695d09f94

    SHA256

    904c94ac59d8869f9e5612e653a7305b009fcf706edcf232b0a9c3caf527ecc6

    SHA512

    e2391a339bdb8f37dab28ccaa05ce4d1b0b28603bcbb59e6abbb8547dd687910bb8d68d4aa54d94dc8ede4c93ffe8e66c6a3acbbeffe509faa273635b9414635

  • /data/data/com.maxqenmnh.xvjrjhanq/cache/classes.dex

    Filesize

    1.0MB

    MD5

    c7d9eac1e00e8db6d3ec176c220348a3

    SHA1

    3425aaef1afe133080c5e1bf17fa4a127e0b88e5

    SHA256

    e71561c8a5fdf25a4ea55fb52158ff023dae374b891434ddd2dd568e0f70083b

    SHA512

    e127a18d921720e91973ba60e5b99ed15679e2154550f77cf3980cc12d0e684068c2f41553f590590f605df201c4ebe6bce70cdfad046fd67cacf712c9bd845d

  • /data/data/com.maxqenmnh.xvjrjhanq/cache/classes.zip

    Filesize

    1.0MB

    MD5

    b33481ae7f2f1967704d9bd4ec78d1d2

    SHA1

    647c9787686c7cbf29a3c787c64ee16fe37e150e

    SHA256

    651636799295b602e5ce5117c03d507655552ab0541bcb5f1e90e0d821e49ccf

    SHA512

    018253f354e4ba97cc403fb0d67de04a6473d7de48bb2a6f4d02e3a1935567292f51fb12bbf281b3c388bb96b35ea1a6773defeae0d9b6470cf90a3cf5052d72

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    e8ca19865362c442b071eeb272f0a2d9

    SHA1

    91ba4055b31a365ee7e1ded30da2e8057d29eb04

    SHA256

    8c147578b4f36acf195ee5b0d82df82d64baae9d502d392fbcdf49665ac429f4

    SHA512

    1688580167f253743334000c080831861981ec02fd45e0ac08a9f02f4a152efd561bee77bebb58cb84fa42236b02d78538c1fa22bf9d91aec24cd8f4763601a1

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    f915ac5e55645a172a482178aebe244d

    SHA1

    44281fb9de330a053faf1afe80b20145f074d0f2

    SHA256

    7a3f9259ecd02921729b25d9adb42fae5a53e1e446aac110cee4948b12fa62b4

    SHA512

    2f5ee097864d8a01ec6a997f3f12132c83fc7fe8a7ac23373c364e570dc847df2a6ae4ff6e23f8652782501ef89f9e7014ad4377fc4b044516dfeb084f72d703

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    958a1716b367264100f57edf8b142d98

    SHA1

    58b861f65aaf2b75521179beb31f6a16d1742ffe

    SHA256

    3c3670423ff05a54c7b08db3c9de0b3c96aa6773d1cc9b23e3a5e8c9d9bd4a2f

    SHA512

    e9226e3e9b2405f6ee12ad398fb34b615c4a2f44c74af269f350bdd655100ab6cd6de30cfc55605d7a2e929c1647aa188218b5a7a7cf67573e51fc122c4d58d0

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    c950dba02ade2bb4d902a69bf5e799cb

    SHA1

    2501435538c6329de07f53358fc3b8a57beee76e

    SHA256

    c707454bae2802d2f9dde10b45d17a4c668a66e20d3273240103572a6fb765e2

    SHA512

    d8317a6843c13a5ddc91e92efc43e96ec394ad26e220f36ea064cf38a1e22d25f5b7b42a6acb153af0cebbc193a18ec574d608bfe7893e642ccdfe7418aac941