Analysis
-
max time kernel
149s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
25-12-2024 22:03
General
-
Target
6cf460d7d8e64fb51d15b15d27c91b4d961c1a38a169d3d498412a668edc3fee.apk
-
Size
1.8MB
-
MD5
8cc582975ad2202c2cab74ffef1f6577
-
SHA1
e4f776b69f54a19b8a0c041917ace1a670816794
-
SHA256
6cf460d7d8e64fb51d15b15d27c91b4d961c1a38a169d3d498412a668edc3fee
-
SHA512
447a43a15080bdb4560663b23623e9bf8f9cd1b02ffb27193eb0cfd07b9fbdaf09778c6ea8cce8640c75bc8074164b59864da4ed0847d7af6c7c4b32dabbb1b7
-
SSDEEP
49152:qgSRISjGA/UHYSjGA/UESjGA/UjSjGA/UBSjGA/UnJM15iZUj:+ISt/U4St/UESt/UjSt/UBSt/UnJMjiy
Malware Config
Extracted
hook
http://154.216.20.225:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5297d431f72853955adacaea13d50c415
SHA10d458287fce8d9717014af8e5a1cadd95ee21cf7
SHA25682dd6c3502b0af36a6e3668fdbe8e31c11cb90e880e4d6cfb56ad104adf58ce8
SHA5125d043d4d0426cef8c718aadfc02d7a9be36b88a12fac45315edbbee0ee1a285c47524193fb427a9c42658a6f76b6931f9aa5bb7324f3e9f963efda452a10b766
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5016541f247079879eed4b07c5ec66f7b
SHA175c57f9e2307b74ccb4d151c679861a74c0e5fd8
SHA256309b4e70f9f936ba9d4ac09111ed5f68588619f1e2a70173681179fc26563032
SHA51207cb260dc114a32db43df53f880c880ef2c37d36ececd4f98361b1026d462924f4364e1ab55ddf641185f5ce489a63e10a7573fa668b2dedeb5b468042921a6f
-
Filesize
108KB
MD51a64850b9ad799414c046c8bcc7aece0
SHA193fccfd9619dde02e2dc8ffb10e7b0ffe2817c5f
SHA2567314b3578431b66d6e04ac3c48f9d53d1286a1fe9ef50c8d2a6648377a11d3b0
SHA51245acb18e156e692a3cf36be1dbb03d406754338f56341b78c00a69a7035cd04c9f08c424b2b72a2ad5711e1a0e92aa6d1dcd363215a938f198860258ac70c6e8
-
Filesize
173KB
MD5c1d2ead619bc831598b0758ddc67783c
SHA1b6019902ce2e151084647e8ef14a85d447689379
SHA2568c3eec29834036255d9ae8d733256d54b8e82d430a649dde834c755e697689ee
SHA5126ef75b19dae4838ea4d5a77cb6abd47a2d40ef7b0ae0d94ec707eb48613f00c2328014d6cd8fced49558b38307e77a0920da3217aa506e8167de10b35afc03f0