Analysis
-
max time kernel
146s -
max time network
157s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
26-12-2024 22:02
General
-
Target
dd6faf815114bd6bf8a1a61c7ea861ee75fb9bdfda65f296cf35ff3feec04199.apk
-
Size
1.2MB
-
MD5
ff20c1ed058c7b07f6de914bfe8ff864
-
SHA1
905b907db77be26695b3b31f58eb6f8b97e90a1d
-
SHA256
dd6faf815114bd6bf8a1a61c7ea861ee75fb9bdfda65f296cf35ff3feec04199
-
SHA512
58caa3c08f8e6b44f45e5f9c7a15d6b2120d0192b52dcdccbaff0efd09eb4b9ff53ceb76aaadfa6b179488fe92cbe3bf244208cb87471cd28e1274a70f4d78a4
-
SSDEEP
24576:lQ3HQHYOTwPJLjDWi0vXVAZu7u40Xv/3NpzQYQaaZA1g7g8in:OXU+gvXVuhH3bkiaF7g8I
Malware Config
Extracted
hook
http://154.216.16.239:80
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.ZtSHLqcbQxqj.nWrOAwBfiNpq1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD58eb0277814f1905e93f25724674f9789
SHA1502342ed982a9f8504774022b26afaddbf37af20
SHA2561bda7debad9a9db9962e15f4cb06d0c0174b5cd3c2cebb48629f19b05dc2ae05
SHA512d997d415095fb46b6f73a11779392a561c7260e98762cdcc435d6582b6d0f95d8356b5d60d3dde4116547b5ed45fe95ddfa46b0521b600c12e40403125e151bc
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54193bd1af50eeaea9c21e83d9aefb71b
SHA10d0c1320fb5f5663d5e0de777480e66e6d4cadf8
SHA256bc12770117a4f2a5094379e355fe46fe146011c66b955338ba0d4f1f049f3b6d
SHA512e769a1ce046f7dc5bf6cc685a206b04a0e8e6b18b14375973d9da038d808c9243d389760d8662e46570f986c1d1db9a24396820fa8e64cc084b086dbed1dbff7
-
Filesize
108KB
MD5db09648c67829ee12e3afd885b1a31f9
SHA1994b9a4251eb9f9cf0809b9c8566ff661b517f5b
SHA256820c7d814062e0172cdd9efc0760ffd4b046cf23c5aa2ae3e6aee0125b032563
SHA512f73ba5f07f4ac575970f034d24e3654ee7e13c556aa3df705ab3ded09d02ed59d7ebb522808ed071e3fab497997d07e83b53eace3786e00681a9265bffb3be35
-
Filesize
173KB
MD50f0b4013be6256821e081470e86389c7
SHA18a33ed9ce7474f9770701786a47cf55bc9ad1b72
SHA2567a223cd29349e3ad9e1440a7c784c4ddfe9bca84606d8ddb75292bb7faee639f
SHA512e0c4d05adc13be83845cad7f580ae8f761ad2a9cc4f63d13b897fc4c8681e5de37b6e1d1802eafcfd457667159e823f87cb0c8f3551446c5dace80ec672f00c3