Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
07/02/2025, 22:04
General
-
Target
4f181b3a42657a4c18a898d84108f7500baf243a2ac710adec1c5938cf0adb57.apk
-
Size
2.2MB
-
MD5
a5fd3c1e089914a69a62086dca829bf0
-
SHA1
eae7b8cce8d1718c75098aeeecf1aa0ca3f35c38
-
SHA256
4f181b3a42657a4c18a898d84108f7500baf243a2ac710adec1c5938cf0adb57
-
SHA512
b0cf7bad8a6709c63d7173779b38f51459111ba2af2e923b859575b7d09902a3db6aee2b555bdff863d9d7f2b212afed88af9efdabbd95834df615d6d4fa94c0
-
SSDEEP
49152:Ig/weyrxOFxzXpyHnekeJPGRonx31oSGOcgB0K+kGH3JeilU:dFBX0neLJnxPmgsh3kilU
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.gayiwefahilumo.zufi1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5d899aa5350b67accfc6f9780fb5d7f20
SHA1580e0fe138bf6fad7d0a529bb3533d615c9c4ae2
SHA256affd9aa4749d23b4cb1a177aac89bac54fd781e0fed0b2280125b9e06c846472
SHA512028ca5f02c4e9881990b9dd0178cee12bc14da4736aae9813098755becf68c21f28880eb1541d1fd09994cb15e6e763bd9869398b6f9bfc8d13819c785460b8f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD56838e236dcd6d358533445329f9c5165
SHA14aa9bdfc97d9022198fdd562fbec6ebcec115bea
SHA25698d25c940e2ffad2f149ef2b0cb8d14cf228b79b3ea7d2dad120e244ae0071fd
SHA512ebfa48bc64831321a89875d1f67889744851203e3afd0253aeb95bd8e0c702710789d8c32e2f213a6597d195e6cab3deda80441891d366ec1ef43f87a35fffe7
-
Filesize
108KB
MD5222396764605d01625ea7e0b2b1acdb8
SHA18addf9361c9b3fa553139714f3cc2a92cff8d62d
SHA2564fd5fe850147293d5a1a6611328c411f0ec9cbe23a6ef0bf825229f6e87cbc2e
SHA512877ae1baefdd3f77b8611c345a1956bb10b14fd6401177cd67af9332d0d5b980e05bfcd63d5f120e8b099b255c63a8f6b431401bc188fc512054de0e4cc1b7e3
-
Filesize
173KB
MD5a2866379a7e6af070154661746fbf6e6
SHA1ed6e8aeb0f67e0b7ae7c10d89a835b25dcc3a6c8
SHA256cd06da377163d11f8e70c82813b31d4cc9c07f0e530fe0b96fce889204d16603
SHA5122a62d687955b3e23ca0a4ae0d4406704f26a3350d980f5375efa4ade6bc21e132d2aa75e8d8ba0f2d124565f64c7df11f867fc13c36ba246b43e2d26479ef02c
-
Filesize
470KB
MD5134de665d39b4527512663d932f8cc5a
SHA1e766f22312bfca5cedff5acde6d5f0b615dc6c94
SHA25668c6851390460770389d1a797e2d1f4509af50f8117ea2f2925473c56a6e94f2
SHA5120d5fb6778c2b935b0227beb882d03f0da24e3a3839743df5fa09180a9f5659235e4a63802cb35dea45dcff5702e3810109d3b9bcee6ff82c6ad8a84942c4c54d
-
Filesize
8B
MD5f798e1b1154bfcef79d29b1eb9d44292
SHA1b31b2b9c54d8499f00490233d90e7ea30dbcddb2
SHA256bf0db525b83c9d6eed76c01a61c69f10ac5aba7a7bb9a999a03c434ab7b65b5a
SHA512409cbbcf958a02f8b6e2daf9d81bfe250837b6ec3f6aee36427979d43646559d8c3a6487f81bcf42d6ff59bd40d4d3e67ebde4cb226445c1052221cda0a719f2