Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
13/02/2025, 22:04
General
-
Target
c1d33a05269fe06bd5ec9a2c9c8496f9e2d64b2299aa88fc5a4976e2f64cc806.apk
-
Size
4.9MB
-
MD5
583d358ff60f7c40fa4c4a408746307b
-
SHA1
df4a72c62ee5a0a3cec8d1eb04215e66d3352635
-
SHA256
c1d33a05269fe06bd5ec9a2c9c8496f9e2d64b2299aa88fc5a4976e2f64cc806
-
SHA512
e1930961953cd8abb7bcb9b0186d2b041fdeb2bc6537dc8286879d4bc497f9e8955f3ccbfdd46eede675ab046b8bb5268a04c9cc40bf287618898506a25c6c1f
-
SSDEEP
98304:xZ2zMftM0Lhe4DQ8ZvippmqGNyLnJ77fcfR0TUy76yamq+bmebhtMU2nEdV:xwutM0L/ZvY4y7ZfcfROOxB+CmNJT
Malware Config
Extracted
hook
http://176.65.134.87
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.uuucfgfjg.gbpeuhueo1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD59549030a483dcd23bc1ad5682a30462f
SHA163f61a94b6dfc9e988f63a6f0e8817acd012c433
SHA256c4b0d4f9bb2e8de5ed907865d4905ef36845c3e8fc8b33a82918c8abd2c4a773
SHA5126a374c86b1bebe04a15aa82b3bce1b0c1bc19934198be8340ff97d77ca49bff1afbcec0a853205fa8cbc9707bd5cb651ff2e63f7ec3041560a35cc11470da13d
-
Filesize
1.0MB
MD5d377533dfd1d649461227fafbab61b5d
SHA1ef486b0d8e37deacb9a0228a7b6e3aa510309216
SHA25653d4054b9e8f02c0fa1a163cf55743006b3e036045ed0bc600d0941ca7131384
SHA51250ee5bfa8a82f3adb824ed6ecdc6e97f29f22a82bb8e86f96490522538ee48df12a08938d09d000765a6deaede529cd3e17211b46c7d307c7d680ec2a8d34b48
-
Filesize
1.0MB
MD593d6ee371978056a6fad04ac50a908ba
SHA1a5380e1978d6d8b956fceeb7661a049367eed072
SHA25658745815a923683c9dd200a996ab314cf4c8ee26537d62e8d72422d89e19a33d
SHA5128256ceacd840d572d7f7e432a09bb0554fdc02774f61e345f475f0225092d826db3933b1af994c0faf15695a0fec2f5c24707c670dba88651e3554b3f2927c10
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5edf0971a6676b3e9f109495ecee20d22
SHA12c71c442aa6b3f768f686542352fb1567658c0f9
SHA256e88ebeac1063a2accb67fcf1852af7406a21c4be847025da3ba089bd07ccf7b9
SHA512aa6f1c028b393b324fb15019824691b14a83f428a808ea3082e66bfc21a2d1b586f29bb58cc30f1d2f6da33ecedd896b5c5aa70f32862d401824a42c71963aaf
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5e8cbecc54b0223e185ebf2501fd46b4b
SHA18f169cafb8e3a1b3000024e0fd44fd31b0757940
SHA256671823c63ea91a31e4eebcd824731fb6bc32f04d8a615ffd7e492ef51547a0d2
SHA5124a8962db8d377155953eddba3ffa38b0e1a7a870888487b0e167c7d77c251fc42602500b95627a00631bdb0ab39e5529d5b6f882e31efd20946f8472a63c423e
-
Filesize
108KB
MD51dd8b6e074b90820c555e7a6f16322a6
SHA16d3ea0403ee10ca7aecd09745cc4235fd055cddb
SHA256f8503827d7bcde4d2f07d0ceac4234dfcc389dabf9a384ba8f5d00c6285c934a
SHA5122a251667116ce19a6514cf223728c7ceefa23fa39b5ef98e9ff3a77fd4a2fbcf17edcd78cc605cb96a29118bdff0adff48df378ce83f1b8497f2c88b964a6e5d
-
Filesize
173KB
MD5b8d071acbc91ea8320580ca6084b37f0
SHA18f2bb37b736b422ad56c1d448f9912390ec3cccf
SHA256de8e06696bc526e3255a4d88dc469ef37677c90950bf7a6d13bedb5b923391ca
SHA512bf1a23a710a695e972d1e13e811c40379567c74f0996e914425fbdbf9e0abbc63acfbf9fbd20ba3703c62ba4823117adde43e5005df5613e00795c7b260d7dc7