Analysis
-
max time kernel
54s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
08-02-2025 02:09
General
-
Target
4f181b3a42657a4c18a898d84108f7500baf243a2ac710adec1c5938cf0adb57.apk
-
Size
2.2MB
-
MD5
a5fd3c1e089914a69a62086dca829bf0
-
SHA1
eae7b8cce8d1718c75098aeeecf1aa0ca3f35c38
-
SHA256
4f181b3a42657a4c18a898d84108f7500baf243a2ac710adec1c5938cf0adb57
-
SHA512
b0cf7bad8a6709c63d7173779b38f51459111ba2af2e923b859575b7d09902a3db6aee2b555bdff863d9d7f2b212afed88af9efdabbd95834df615d6d4fa94c0
-
SSDEEP
49152:Ig/weyrxOFxzXpyHnekeJPGRonx31oSGOcgB0K+kGH3JeilU:dFBX0neLJnxPmgsh3kilU
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.gayiwefahilumo.zufi1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5e2ebdf027ad58b33b486ca42938563f7
SHA14b7c0220f43644f7b9757aa0ac007ea95c3d9fbb
SHA256ab92d0288ad4652b2a107c0ad81182d0f4522d5daf795a856e618a5c3201cd52
SHA512faac7c590d2e639d5c52a96b3acaa2eab290f73c35048505335e7e65ea26aaed3d5e20210f9170283c11d6ed66ccae1f86945382620c995d083df71d157c52b3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5a22dc4c90b7b6ed0db7d2b2beb46d66e
SHA12c5e5eeaddc18033887008595c940c9157517bd8
SHA256517c0705362547e30c02a6e2843f632bffc6f1cc6236d493f04a8ff713d8bd44
SHA5126e2b06cbd526e21d58f4394150f413b4fa89e0f6f73085faeb33323ece32573268165a6b7ceb1470559ebcf29c678467b5d4ce7dfc629fcbf5153be48067cb78
-
Filesize
108KB
MD574f1565a38ef86fc6c6a88886c8a2aba
SHA174a1730f6aab4f0c5e6842959607b7efab350693
SHA256e3cc50f60b9a025c987ceab24b76bbeaa8a9d144be39a4151897ce811d815b6a
SHA5125849dea029a8a49856ac6fae56bae00f5583361e1b5b0637d400d24047ebe668c2fb71b7e0e1fe01e0f206611d8f838d7bf88973c5c4d9534f50c41da4a7e88f
-
Filesize
173KB
MD5bfe65da35331c7d34f04410b1d0709b4
SHA181bd171c27e69aa02f170bfc9b96d8e7142eb373
SHA256814f9b07e1f62197ad48799ed3ee603b4a9448c1a9bcc1a8991acd18f37a7bbb
SHA512ffcf0bb5ab5e6b47ad938995416bd9812a5c05c59fe784d7f67ab4bef1fc6b8d7a6949bd8f4682adf696b7122b185cea6167b5efd9477b4d85fa1567f69e9fc5
-
Filesize
470KB
MD5134de665d39b4527512663d932f8cc5a
SHA1e766f22312bfca5cedff5acde6d5f0b615dc6c94
SHA25668c6851390460770389d1a797e2d1f4509af50f8117ea2f2925473c56a6e94f2
SHA5120d5fb6778c2b935b0227beb882d03f0da24e3a3839743df5fa09180a9f5659235e4a63802cb35dea45dcff5702e3810109d3b9bcee6ff82c6ad8a84942c4c54d
-
Filesize
8B
MD5f798e1b1154bfcef79d29b1eb9d44292
SHA1b31b2b9c54d8499f00490233d90e7ea30dbcddb2
SHA256bf0db525b83c9d6eed76c01a61c69f10ac5aba7a7bb9a999a03c434ab7b65b5a
SHA512409cbbcf958a02f8b6e2daf9d81bfe250837b6ec3f6aee36427979d43646559d8c3a6487f81bcf42d6ff59bd40d4d3e67ebde4cb226445c1052221cda0a719f2