Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
13/02/2025, 22:10
General
-
Target
8a07f00d54ed684734ba6ed89e306d72711ae7bb5296e0479cf6ca39b40adff7.apk
-
Size
4.8MB
-
MD5
68128de6225eb9c983b686ae320ce1f9
-
SHA1
4211386c6695a0a177b2c486705e43ecbe7788af
-
SHA256
8a07f00d54ed684734ba6ed89e306d72711ae7bb5296e0479cf6ca39b40adff7
-
SHA512
a13de8a28427132cdcddb083dc63a72044fb9bb726bb629a8eaf16377a18ecb34f69df00cdb35c0bf4c2d7136ee276d0ea391a82dad21e2864a754bb59562006
-
SSDEEP
98304:ulKFXt8vbjMlqVSyX9WriX7htsurWusJTtE39s9wmwhZmBazSRLQhD1RRu1KPBNm:9FXufMWyGX9uurWua63uwm0SRLQJRu13
Malware Config
Extracted
hook
http://149.50.108.36
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.hcjrgqjez.vxitmzcrp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hcjrgqjez.vxitmzcrp/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hcjrgqjez.vxitmzcrp/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5ce583e6e6da90e58ec97b6179f9faf62
SHA1285c6136fd0361004010bb790ad617d8c0bbe337
SHA25666bb5fd874f4a24f68b84ef258365cbda977bddd0c97acd0ca842458bb5f1f5a
SHA51288ee915a2ed6c47472ce86d931d4dfcad1e707a33a33763db537b068e76b018b86b2e9e27be6d052e02f3ba291db88ad6ad4048cdb1c2c3e895ac9ece72d7bd6
-
Filesize
1.0MB
MD5eda8c5fc5e3b5ed93c7cd904256577b5
SHA135e0b3f16c5e8e4026e4939741f150c4a6839a5e
SHA256f4b32fac3b0f98f6ca6fc05b0cbbe4d162d10ddee3e86aa3a32c9f1df33207f9
SHA512477c79124c22aab6977291e2b3ee1b5069080663707606c32c2a18cd4e73c6bde52ccc29a9c2869cd11f7e6c6f910d2228909a29fc2ad0293e72723d8c54a150
-
Filesize
1.0MB
MD5ef45bdf063d1cb41eab01ad4d4fc981f
SHA10b7073142d8515683f3015dfcc1e721d8fb9efbd
SHA256edab5abff47a7bf2c7a3c1f3e28d5eaf524af974761cbe7215d5f8f07f6ba056
SHA512986e288a48f0e4eade5525e707be4f528c5121c91331edcd308d89ebdd226877b9184d65c411b8e3b6f2deaac72e6f19728c949be2f1d3af059c5ca8850670be
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5172edf7afdf9c7ef2f88d715e1da8756
SHA1be6d3f0624817971c04730e1a79cd2a1b6ffd8fe
SHA256e3670a6c2aef4b856f8c0b659a75ad6ea70f607696eae87cec4079a49189c1e6
SHA512c462e8685e1d9f6ca8039fdff03f23b26f1ad04d32781ba5f17a1d5deb1fab36f66c1e20ac0cf8d1e3d29950ed6e410b1e87ec3496d3b65e9b33f035c0cb0a5c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD54b81cb535c3d9c53254dd57c48f81d87
SHA133f7b0d0f7c72ca2dcb9770127f34c452317fc68
SHA256de8f8cc37ebeaef1772d81ccd2343a2efe46d308c20b2e72387303c0f2ff6519
SHA5128f448f6c068dbd5318f919fa9a0b4b8b0309159d20cdce9e1eaed70d082b96891f3cc5d552701751a162e6cc4ce2d7460fd3b630230b860a17284c206181b0ce
-
Filesize
173KB
MD5a4d57e5f1aa677b3642ab5411a6c4f50
SHA19e1f72f94904a9a61f0f2b0c45e316d0ecd26699
SHA2569fa4f8eb9e31689bb9f315940135f95edec35c8fef4a0e1bc5ea22a40074cafd
SHA51286cc75cfd6ec4000d0d69a728226cfa7505e538d1979938d5f2897b25af706cf3134e55b34ea72d09d37452da5c765dc30b19a03a9870e83e2d9adecd96835e7
-
Filesize
16KB
MD5fc8d055f4a6022a7e6103fcb0bde951b
SHA142bafb31c9eafd3e9e49f44b5304e455464e0481
SHA25663e50d7aceb56b0e2b1078f8a235214080f1a8d6b8605d02dbd354ef2bd43484
SHA5122f02e864dd37fd85e244922eed53f197cca677fcc84297b7386c48182a676b19c52969a9702b70107931f28bd6dd0150ba565fee894b3b995dfef4abb96738b7
-
Filesize
2.9MB
MD53cbf09d9f7f127b744cfaa65288c288a
SHA15b1af698c78c014c7c5a2919e8d553d629e86b5a
SHA2560aef543390ca5a6a17c9b0de0c0a3cdbb67df50be1da65482982f70d3440895c
SHA512239f9b701aec94e0760f08df897b8bb35a600852c06fcf0d67b8ea3dde77b6769403ce5b6f289aad55e17cbe7d46fed194d6dc896a9672dfd117f7f0f58a9f40