Analysis

  • max time kernel
    143s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    24-12-2024 22:05

General

  • Target

    3d09cdd6bafd224006b7b5ec73a9b38b03e35eef35d9235787726b6ec6dd24c8.apk

  • Size

    4.2MB

  • MD5

    b18f2b90588de368b8523615a4fa6e1b

  • SHA1

    46fafc31aa31ed17b3e309b45cee378403aa7105

  • SHA256

    3d09cdd6bafd224006b7b5ec73a9b38b03e35eef35d9235787726b6ec6dd24c8

  • SHA512

    37df3b3bd92020bef611968a8bd19fff96de07f18f6b8a4a2195b59924db0a6a8733bb79912419907f7c32450dbab76ae8755fe6314d471bb1556ce95728fc0a

  • SSDEEP

    98304:PUAC9g3yqlp/QFldx2HQj5j3B8uRRz206906:cv6CqG0HQdjxKb66

Malware Config

Extracted

Family

hook

C2

http://193.143.1.24

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.maxqenmnh.xvjrjhanq
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4609

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.maxqenmnh.xvjrjhanq/app_dex/classes.dex

    Filesize

    2.9MB

    MD5

    3b3a6c6d45f3ea0a7e52a9335ffad291

    SHA1

    d5b5ecee628e8ac160654703893338f695d09f94

    SHA256

    904c94ac59d8869f9e5612e653a7305b009fcf706edcf232b0a9c3caf527ecc6

    SHA512

    e2391a339bdb8f37dab28ccaa05ce4d1b0b28603bcbb59e6abbb8547dd687910bb8d68d4aa54d94dc8ede4c93ffe8e66c6a3acbbeffe509faa273635b9414635

  • /data/data/com.maxqenmnh.xvjrjhanq/cache/classes.dex

    Filesize

    1.0MB

    MD5

    c7d9eac1e00e8db6d3ec176c220348a3

    SHA1

    3425aaef1afe133080c5e1bf17fa4a127e0b88e5

    SHA256

    e71561c8a5fdf25a4ea55fb52158ff023dae374b891434ddd2dd568e0f70083b

    SHA512

    e127a18d921720e91973ba60e5b99ed15679e2154550f77cf3980cc12d0e684068c2f41553f590590f605df201c4ebe6bce70cdfad046fd67cacf712c9bd845d

  • /data/data/com.maxqenmnh.xvjrjhanq/cache/classes.zip

    Filesize

    1.0MB

    MD5

    b33481ae7f2f1967704d9bd4ec78d1d2

    SHA1

    647c9787686c7cbf29a3c787c64ee16fe37e150e

    SHA256

    651636799295b602e5ce5117c03d507655552ab0541bcb5f1e90e0d821e49ccf

    SHA512

    018253f354e4ba97cc403fb0d67de04a6473d7de48bb2a6f4d02e3a1935567292f51fb12bbf281b3c388bb96b35ea1a6773defeae0d9b6470cf90a3cf5052d72

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    9299c12d5705a923751eece83335c322

    SHA1

    53d5aa91e321c4a6fbc9e53a8c446774dadfa8cb

    SHA256

    fb169c58b328731f3121cccd6acb67d7828ea1cc0525b1a49fb7797611796e7e

    SHA512

    9690cdea95bf883f96f1dfc3f4a565f00011149858e7cb513bd4ceee14324bdd2fded96b84ee3593521eeb0996273f87b6ecb6afbb438b12e0480eefd8364765

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    208c2a0e6d7de793d17995215777d61b

    SHA1

    3bf600dc262931f51d1f624e1f91fec5883f7568

    SHA256

    09af3bb084ef32905c876fc70dd98223d99683534d3ac86a61b14d441aacb073

    SHA512

    1b5fe6c3e8c8e834f60424a5fc6bd9147017448a8e285d41e6f6bb31a3dfbcbdc63347472fbb5a117ebeca6a91f72d93e6db7d744f3d007188e9aae7d83da0de

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    d90d1ac93c70ac954ac2363109ccd8dd

    SHA1

    43a5971581ecf4a3921d88d7ee105ce29886bbd5

    SHA256

    e2bcd97d80eb831a0c970be1300e13fb872b45ee7db413df37882e9c8e9269eb

    SHA512

    3041f29b092319f68eaa5d71004f697061dbb4d2fcd80d5060c89e9dcb47a8e531c51c138be19c4d54bea3f3199c51a5a4d0b6b4340722229f591a3e969e2ea2

  • /data/data/com.maxqenmnh.xvjrjhanq/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    a77f30d0593134eefc20c6f31962f052

    SHA1

    f6987ba1181e28e72e74a4508957df982c07c276

    SHA256

    9b2a530616d54e15d33c6ea891f966939abde6959b7129c2aefceaa43781f0b3

    SHA512

    251c59f762f113790048d655be4d1f6e36f5857faad0ece02ce8b9dd3e42b0c49e0b407cb809819caa0f12936886d5b3daa0185f6ed60ec84f6169b99ce7069f