Analysis
-
max time kernel
145s -
max time network
154s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
20-01-2025 22:04
General
-
Target
ca701542079f8415040d48a53ca6ed48d67d9a51978a3d4368b3028b6c2721d2.apk
-
Size
3.2MB
-
MD5
bbf3191e8a9d9192b6fc1c17691398dc
-
SHA1
8f739cbce28c68eba7c14b2e9b60fc7178f5c99a
-
SHA256
ca701542079f8415040d48a53ca6ed48d67d9a51978a3d4368b3028b6c2721d2
-
SHA512
80ef21c245409070e2fe4176ae055bca90459100981c5a3e1a716773162dae4789107752adb46c8a7af98cd94cbac9fdb2361b3edab908f41f59f22a7759a3a6
-
SSDEEP
98304:bjCZrsWTOEbpX6PNudMgczeoMgA3NPG+dx8++xL3LZ9R:bjCZbppXnsSjg8JdL8t33R
Malware Config
Extracted
hook
http://147.93.98.67:3434
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.cckiller.app1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5de745ab23d5f17a0b0388a64cb86f8ef
SHA189a08dbbae7b8d93c52c9b6348628635f5312f3f
SHA256fdda7875cb728e9289ff50b4eb726307e70df9bb3bbfcb60887dc49650edc3af
SHA512b1ee8392b2b3f58f197841aca2fea1596ac3935a61b6fb9ca4d412eb950165835fdc52c6ae4fed3e1542ef2a5b9e5af36f212bc246c234f9593a0f3913d24064
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD52a4cf717e708bfa86eee3caffe78d743
SHA1151b17693c3feba47b0abe7cc65bb24af35d699c
SHA2563f8fdb42a02ab0615697e735222eceb0b8b4e15e4ef2c6698afb0035381358e2
SHA5125471b2277e4c9dea295760b519ba1895f60ee85f30f282797e80d197a93a7d731a55a92ed25540ceb63bd824c2f74d9c7e1fdbaeadd10e14561f74a921fff8d9
-
Filesize
108KB
MD5ecfbd82de6d148c413fee62a01261d33
SHA14d696dc0ec8d085f8409554df28950248ed3939a
SHA25653b48accfa915ba05a6c6a8e42a59351855fae4aebb2abb6483dd26ebb1c98ce
SHA512de895dc752c5e24019e0d91ca3762fd10b73d7ebdf8e1b7a4b6a4ae1b322f0c1e8f700b099be252134403a33db472d089255adca5279ff004788b030e41d9905
-
Filesize
173KB
MD579715da8c9aa5f22d5a3279cf6255533
SHA10f8b6d40172bee94b10b0f540a959cf1a12fd42d
SHA2569e56836ff35802d7ae8785059392ff557725074244b555379f4805573dad6e60
SHA512c8dcda9313c3a3983133ecf05e7786aa0fb65f94512b2d9c887090180c4c079cb6bc0861c085e0082d054b67ad3f4d871f821ff14ffcbea1232ce216e18a983d