Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
26-12-2024 22:03
General
-
Target
89a9cd704601674432722b534cab5f678e79a3eb85dcd6a5f98c7880ef1f2069.apk
-
Size
1.2MB
-
MD5
73d65b892c89963a9541c55d1b75c8bc
-
SHA1
c0224bc9f1840e895c4d55c54321f922a38fbd62
-
SHA256
89a9cd704601674432722b534cab5f678e79a3eb85dcd6a5f98c7880ef1f2069
-
SHA512
6fff3df2d54185ad897b4d2da53a1a72986aaa70bc9e0c5004540a6018312dac89a254edae537e9247952b9cfcf23486ff8a60454467e1ba3e113d9ce7bddba1
-
SSDEEP
24576:D7g8zyUcm4t64TudslPkhuS5SD1rCP9BnVEv9Q5vOSERCy+JvsBiU4:D7g8OU3slPkhuH1Irg9qvOSEsy+JkBib
Malware Config
Extracted
hook
http://154.216.20.225:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5aca4058461d9e7042e909e77a5fe9cc6
SHA1acee9c31f2cdb4f290c1680e4d4ca699ada28fc9
SHA2561cbc2c55c8fde29296f5c02e28b3b5bed4b02b8b94c892d3e1dc88da26805cda
SHA5129ac0e8fef9a0bf2c18c358dd7f609e1673237decab5ec5838b53691b08ba6db77bdf52e9e8ce551a0c1cf2029bc815d762e13c557249a509574d63b023b0d5d3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD557afe0c5c0a10a42d8b455cbf83494fc
SHA19d69d3c58ae9c26f49074d2bfbde019a6b2a1c2c
SHA256f5d918c506a9cf4e298edf5e1c51047ecd0014a30f47d3d75a28a5439d97f363
SHA5129fc83d10654ea2e092b453c727c90b10459985c80228769bb60a1158fdfe71dcb397f07f805fdd92b878e04d47bfb41c5b73121b98f5e5c8c15cbc5c2c5b7771
-
Filesize
108KB
MD514b6904a09e17136a1088cd2d48e12bd
SHA1f35a3d6431091ea53be0f78d1f331eaba52e70ab
SHA256fdbdf38110defbaab4bd87ba070223f5be4af42cab07a0972e26fd0616f68ec4
SHA5128fcb3f612668111a946362abfbd329493327a1ad184c1ce5ca0d7b5341940f1ed8f51f1659b377e429cee469dda43a2191f959118ab83dfbf4d62e040961d998
-
Filesize
173KB
MD515aeacd25c4854bb942484299abd8dbf
SHA101a743a6505fc5e7aad9cb2d05eda5715c317514
SHA2563b6352e33e78970d9055164e0cb749335baaff62c0a998a8f64c803643df1e54
SHA512bfed7630ce172900ee41fc39792538fb303a2e74eb0ba7173519ce42f1bf7e779ef5ff2ed3b86de1931206192372d4af334bce8b7595d25926ab38ba6bd13cf3