Overview

overview

10

Static

static

10

7db1f324be...ac.apk

android-9-x86

10

7db1f324be...ac.apk

android-10-x64

10

7db1f324be...ac.apk

android-11-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    28-12-2024 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7db1f324be5dbcfb0ade28ea33988c918454b4a3f193019780d9dc6c850d1aac.apk

  • Size

    1.1MB

  • MD5

    2542306445c8c6c4aa9566d08cb05e7c

  • SHA1

    cd192ca318802e544ffd6895b9613dcec22c86af

  • SHA256

    7db1f324be5dbcfb0ade28ea33988c918454b4a3f193019780d9dc6c850d1aac

  • SHA512

    bf12d5ab9ee4e8b73d0fa0b3798f415df2b3676839d5edd91276f69b76da6d453d32ff024ae684d418f86238a376dcdab171703c2c96fc4f5e25b75500a6a22e

  • SSDEEP

    24576:Hg/uwS9glMwZV1JIc8IVIDEz/ZC6HKTvpQ4V7SC1FsIE30IPwl:Hg/gqf1NVIUZdHKtbVWC1uBEIc

Score
10/10
hookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://5.175.237.86:80

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.lpQuvgVMRvvH.IVzHaZpFvCrD
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4273

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lpQuvgVMRvvH.IVzHaZpFvCrD/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.lpQuvgVMRvvH.IVzHaZpFvCrD/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    d0b18fc47ff82e3f354277e2de0bc5af

    SHA1

    17c9d50d8673350f85bfc070f358ef83432cb482

    SHA256

    7006a8f0e37cd690881f1037173a63476e9bf4bfca5b2708c4c7f4d715a208e8

    SHA512

    49c8054bda3ec41063ea0bca490bfaec398fb3a05d754ce2ba552d71009655b4f7daa84160b7d6c848e0b1a982828c3c7f891712b7a1233c5b7f2005a38b07ca

    Download Submit

  • /data/data/com.lpQuvgVMRvvH.IVzHaZpFvCrD/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.lpQuvgVMRvvH.IVzHaZpFvCrD/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    40d1ccd265f92293a27373665ec212de

    SHA1

    6a9a6e2d892341bbfaf80acc173c59526f145ddc

    SHA256

    7679e785dfb20777c1184893991d54b01117c0a5194b49f03949be03410bc199

    SHA512

    4f6132e2f7179f804b6e845496ee393c652a9706345d3d0186c3de0bc0b3e90534d0274aec80a396803f83bdd749929a5395def388e3d38f62a73f58a0aa7e4e

    Download Submit

  • /data/data/com.lpQuvgVMRvvH.IVzHaZpFvCrD/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    6c14c9ad7df2b2336b89e2cffa9e2761

    SHA1

    bd375d848f350307a3f01afafda6a71fd772f5b9

    SHA256

    cbc6ccd23c840d020c9c4be19d3793e0346c02d231d7fdcb734e79f68e4f9281

    SHA512

    2246eed7d42ee1d0ad32a013a22c04a058ea421b3f60dc8e5682d87d3ebc90ebaa64788c50aa9e2b06d8466d6be2fd48f8495caaf950772e0fcff6a8d8eac478

    Download Submit

  • /data/data/com.lpQuvgVMRvvH.IVzHaZpFvCrD/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    ba89e4b29e61670b10350c1e6746a8f7

    SHA1

    00fdb870ed77bf9f7023ebb4594b6f1852fe1370

    SHA256

    481387aa2446631a840d20d0a86c4fa7515089ad8769c203ed9acda07ce7df51

    SHA512

    484fca232c78b9caf0bece9c695a794efce4ce8f463581c4c8fed4cd290a7ce6184b371ba5f27c8b0c2e8f994523da673857a776136834347f5f5ecc0512a5c1

    Download Submit