Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
13/02/2025, 22:10
General
-
Target
8a07f00d54ed684734ba6ed89e306d72711ae7bb5296e0479cf6ca39b40adff7.apk
-
Size
4.8MB
-
MD5
68128de6225eb9c983b686ae320ce1f9
-
SHA1
4211386c6695a0a177b2c486705e43ecbe7788af
-
SHA256
8a07f00d54ed684734ba6ed89e306d72711ae7bb5296e0479cf6ca39b40adff7
-
SHA512
a13de8a28427132cdcddb083dc63a72044fb9bb726bb629a8eaf16377a18ecb34f69df00cdb35c0bf4c2d7136ee276d0ea391a82dad21e2864a754bb59562006
-
SSDEEP
98304:ulKFXt8vbjMlqVSyX9WriX7htsurWusJTtE39s9wmwhZmBazSRLQhD1RRu1KPBNm:9FXufMWyGX9uurWua63uwm0SRLQJRu13
Malware Config
Extracted
hook
http://149.50.108.36
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.hcjrgqjez.vxitmzcrp1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5ce583e6e6da90e58ec97b6179f9faf62
SHA1285c6136fd0361004010bb790ad617d8c0bbe337
SHA25666bb5fd874f4a24f68b84ef258365cbda977bddd0c97acd0ca842458bb5f1f5a
SHA51288ee915a2ed6c47472ce86d931d4dfcad1e707a33a33763db537b068e76b018b86b2e9e27be6d052e02f3ba291db88ad6ad4048cdb1c2c3e895ac9ece72d7bd6
-
Filesize
1.0MB
MD5eda8c5fc5e3b5ed93c7cd904256577b5
SHA135e0b3f16c5e8e4026e4939741f150c4a6839a5e
SHA256f4b32fac3b0f98f6ca6fc05b0cbbe4d162d10ddee3e86aa3a32c9f1df33207f9
SHA512477c79124c22aab6977291e2b3ee1b5069080663707606c32c2a18cd4e73c6bde52ccc29a9c2869cd11f7e6c6f910d2228909a29fc2ad0293e72723d8c54a150
-
Filesize
1.0MB
MD5ef45bdf063d1cb41eab01ad4d4fc981f
SHA10b7073142d8515683f3015dfcc1e721d8fb9efbd
SHA256edab5abff47a7bf2c7a3c1f3e28d5eaf524af974761cbe7215d5f8f07f6ba056
SHA512986e288a48f0e4eade5525e707be4f528c5121c91331edcd308d89ebdd226877b9184d65c411b8e3b6f2deaac72e6f19728c949be2f1d3af059c5ca8850670be
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD535b0e2b2833630be95b9bd3515f1d286
SHA138bfa7e107aeffdb1ebbdfb01dc765b6d406ee66
SHA25630b25be96fdee0c8a2548110439ddf90c622c0dac78ea8a0869ddf3f5c03c7a0
SHA51219625755bedc3e5f90a01f425c84438f72698dc99a302d502c4e75bbd90555ba951358f7ca820ebcbdfd5c75ee169c63694fb7b65e465d37f072adea870581c9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5a43a16ad726bc383eb868a26eb715bc1
SHA18673957df38eaafa1d83977cbc3ea6cf0142f69d
SHA25670e292b6ee569bc6185bfcdf78bf56adff7ea0d74e6d87bda7c87e082acc5363
SHA512cd41579bfa9cf4ca642c80382cf05186a3913d18a22a368ebfc0ef03c8efbeebdf79ae7928aada0e9dacd0f6436a663eb7af12f70d6a7598fd74e13c48069dc5
-
Filesize
108KB
MD528c2115a36c3cd8977c4166138bafb8c
SHA1c23d5036f6eead48da18a1d0e1ace084f4f4f6ce
SHA256bf1e55e20cc9186537cda5ef7f17c188df0c0929307583cd7405a133ace651d6
SHA512669a723455aba1f32d5e500bafd89a1e8c2fef54b4a11a3889dc197f4ac57104f2618828438ac85fda75b4b5f0cbf948a6658a8a216228d048e03f2177803b39
-
Filesize
173KB
MD5c29c8a9e206e423cba22b180398d2f8a
SHA19f17e481e3041129f7b67b1ed6fd59309c26bd71
SHA2560b4e2532210561e3e9af1d4dea598fa429ada92f7e01e068bc56d02f5ff41fd0
SHA512d868b52bada14bcb6da4128f92e9b4fbd7724ab92d24df3218d918c1e669a024ccb5fac9599a72515b55bec3a96faaae9563f878f902f40db8eda874c4b8bada