Analysis
-
max time kernel
149s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
21-01-2025 22:10
General
-
Target
58c7abeba7445180b4457d8dc49fa4a6d80e48ddf8e680d85a459d399b5c1a36.apk
-
Size
1.1MB
-
MD5
68e63994ec885fedbd138e59d943f05c
-
SHA1
801e7abd9cbec73ade32a8c3390f9bb68382b73b
-
SHA256
58c7abeba7445180b4457d8dc49fa4a6d80e48ddf8e680d85a459d399b5c1a36
-
SHA512
f5073739cad21b98960ffd821a6ce423a3aca665bf9f33eb4754854eba957dd5c075af084e2240ad301e1e53aac240d6cbdbd7b446ff0fca82b143877f37baf1
-
SSDEEP
24576:IXnuof7lpWIQJ8cHR/UXqy33Q73D3C/IPTapz/ojyqRdg/y+fez:onuojWIWhHR/aE3D3sIUXidg/+z
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f028f23d81d97c2b51e00469f0fd8489
SHA14996bdf0f02c913017302b56e81c90335378ce90
SHA256dff222cef37397ffac4828ae45a8de55f551068e92f21300c5d10a512573d2fa
SHA51243de2782a4f08ea30bc9e2718ad8efa5ac4c77e604624d50c0912dcb0d27642c1d0733cb56c44d50829c204a623ccff8346dc7a2c711b9477ef9b46fbbf3829d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c79c09c3e50a413dc690ef2ff5cd8aad
SHA1348671cd55294f486fd9d2e7d0705feffb448124
SHA256d5ec51be9855421806844ac0252a5fa8ee1f1663f606df554230d157890280fd
SHA512b368dd3f6af5b039123508197fca56a799511441b4cc233dadaad9792b8303c7bdf9efaeaf71074298848f8a17c5391ef78ce7bfb08ebdb90ab0a99f217f7741
-
Filesize
108KB
MD59ffe4b05d92053c56aabc544be7936d0
SHA19e960f018cc771b1abe66190e5f0d0d625cb9028
SHA25604ed919cfe976c6db3a35246611df6fee0df31d5a7306b48659df64a8eff5324
SHA512adcc35c8d511968dba5bac57123887c7c721b020f665ad8080db6b6dee9a6ec8bdb8ee3c8f4ab15b3a76ea3719e93b2fe00befa20ad76c2b047369ca4af86a77
-
Filesize
173KB
MD56703dcf90ebb7d1d20139d50bf7a7968
SHA1881c0089fc670eeeee98fba00d36d4fc6f58536e
SHA2563c706797ad436949dba62e96e1928cd008f89338acc4fb2af06308c0066c34fc
SHA512f0e5e4b4ac8784d8f6f9fa3b1f93f661333a0b2df8e3154b4e623eee41ff687282b121cb1de6df911550e469baca3e12b1ecd88787ee82298df2fc0a9eba0a65