Analysis
-
max time kernel
87s -
max time network
155s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
02-02-2025 22:01
General
-
Target
cce04cb91dbec882a13ea73fa7a1e176de12156780de035e211007fb6584912f.apk
-
Size
1.1MB
-
MD5
bfab86bf9fbe9628192794a61bd86ffd
-
SHA1
6c7e4043fc1ef37f01a8c33468da834a603e7dae
-
SHA256
cce04cb91dbec882a13ea73fa7a1e176de12156780de035e211007fb6584912f
-
SHA512
60b3643e3f3aabf73ab91de8a92c0ca2097823602b7eb6f2f2b79ffa91321203c6cc9ffac5077da7efa14424bdd8b3f5e48077f29e55f5f97e5ef9354609a6e0
-
SSDEEP
12288:axQJfqXvPX4BL2W86AQSdUGaKOlWV64mtz3wB93oADbbyZop31ysDErMawLgA4qR:aq64xDyOlWU7wB93NDWojyJwLg/pWxH
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.sugilanusetuye.nitoni1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5c70da55b447e5619dfa30ff56e3af624
SHA16be1979833744983e354d0df2983f75eb6c3b7d8
SHA256adeb81e987bd5208495e852d8958bf6ff39bf80553900c2e44b7c5d2b4a7eb1a
SHA512ab5c1d6a87a356db4dea9acb9a2609602d1f45f1b92d2c590fc08ab88fb9a6ef80affe9fc4082abe5811693e8aaf5d7aad8435ae6186225cfd853c1ef1686212
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b8552301c00709087629303c29cbc4a5
SHA1deaa4df618d316f4df4505b076c065b1dae27dea
SHA25643244f3f3b42df4facb4bc3b61f26477680e571cd540813bf699805a2a8ba900
SHA512ab3219729b96d4a2d47d8d554a50463c92e7ba8ef61237b15d71a598d0c7e4d22885d7133c74f347d54c0d985ee66980d8c1465592c6ec318647ae9861d896b1
-
Filesize
108KB
MD50dd624a309eb4a117043973cce62432f
SHA1b5084695bae0309baf2b9a19c4fbeffdf586c373
SHA2568ce4b668d77810f00ca6a99e79b30d2e3895e8a0eb4627387a38b973cd93bdfc
SHA51248cd1060a2eab074f2c094b5c5802492219b97b4ecef600fdd2f1c2ac3117fc9d3c4adb235901f4323ebf8b5003dd8e9ed3aad24502aa4e7c216fecf9bab72ae
-
Filesize
173KB
MD552374d70d027126159d95066d38703ec
SHA186dc6df34b3d335608a9fe9f98ca2dc982d3d354
SHA256af70e89782b41481fea578fc757e4e2d7b307366a6900549afd10ecf8d7c9e5c
SHA512c78b4262eaf7f32787d9f138286f69533512de871cfe4ce3b8b39439579a3c139a21f1cdad8dc13e4963b3998c30f0274a97348961418a663fbd322676951bf8