Analysis
-
max time kernel
149s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-02-2025 22:01
General
-
Target
cce04cb91dbec882a13ea73fa7a1e176de12156780de035e211007fb6584912f.apk
-
Size
1.1MB
-
MD5
bfab86bf9fbe9628192794a61bd86ffd
-
SHA1
6c7e4043fc1ef37f01a8c33468da834a603e7dae
-
SHA256
cce04cb91dbec882a13ea73fa7a1e176de12156780de035e211007fb6584912f
-
SHA512
60b3643e3f3aabf73ab91de8a92c0ca2097823602b7eb6f2f2b79ffa91321203c6cc9ffac5077da7efa14424bdd8b3f5e48077f29e55f5f97e5ef9354609a6e0
-
SSDEEP
12288:axQJfqXvPX4BL2W86AQSdUGaKOlWV64mtz3wB93oADbbyZop31ysDErMawLgA4qR:aq64xDyOlWU7wB93NDWojyJwLg/pWxH
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.sugilanusetuye.nitoni1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50de89ee5dce3b540423aafb4c972d8a4
SHA1b15521947b5d64deac2a0afe61fb106227a76a5a
SHA2567b3aed32c4ab80fe4f3177b22fa75f311062c6fcc9f6593983291cb15b8201fa
SHA5123b3f8a1bd092de998771b6e8be0f7fdf369788922cef751bb39601a3ce3e16f3b256c7363c7c7ac8368c7f16d761c399761201c2405fbdddffbff516e1f62eba
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD530664010296c659e17bb507c7563cff7
SHA1880edf822ea68ebdae902b6a9b46f7213f91c6bc
SHA256039dd85b6db32a8bb73d29c2e242a6b977a822fce7ee5cfff168a156e5f42d68
SHA512808148c953b24d4efcdedba263b08b81f2e04dc1aebea63f0eeb774e1215fbd3d3e1ab573ae0dbc4ed7510e7db03c67227517424441c8afac7504c12df1a269d
-
Filesize
108KB
MD54df5e1685d804baa4307a2bed52713e8
SHA112da1854da1dbca846e687f6b3dbd2429de8390e
SHA2560c8e2afb8f2d219ee57f37fc4c56a4d86dd08f97acf9901bbcacb146dd13b813
SHA5122f51398e79326d2d3dd8e0c26b273003db61a800b70dc9e83e33d009ee50a58bf625da62784c7f13a36ce8b4cb7872302c305ff102a5d3fb4cb3243829223238
-
Filesize
173KB
MD5951be82ded0404a2014c52a87a58da6d
SHA14f2c96094af32e70a2902a34143fc89a7cb2dbfe
SHA2564d4ba0237bde9d4825c0cbbf3c45f83f2137a677d9c6b1613536bbada820cb41
SHA512650725075990acf159edb9c0640b6959e9d2362efebc7510e7d90a35b04ca3479ea705ccb92ceb214c06e0372a14d6d73ead6fb542d83f96455f1da54a2aa6d5