Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
12/03/2025, 22:09
General
-
Target
64143021d11c09bae94664aa453fa828f942b3c1be8d26e843e8e266247b7b2b.apk
-
Size
3.2MB
-
MD5
8f1b57d44045fd3512dc1b0f7158a378
-
SHA1
632cf062ad0a5444489010498d335c5115f4141d
-
SHA256
64143021d11c09bae94664aa453fa828f942b3c1be8d26e843e8e266247b7b2b
-
SHA512
67f3e844c998df3db6f343224de1a036c1cd72915c02838099caf2fed8729e3ef148d80ab3572bf6002fd9be6f5bde6803fdf1d67c5f6aa605ade220e515b548
-
SSDEEP
98304:u/7w9rFFAQ63ATlamT5kUl+jRr3MtkFQXW:LFFA3NmttuMed
Malware Config
Extracted
hook
http://156.238.247.236
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c9bc45a1362c4115e57055a6324c88da
SHA174fb53612d8c1fa54ec1f1935fd6896c0d13455f
SHA2567e04de65775d278ae960c72affa0d4472e8c413cb6526bb45454c030ad0f367b
SHA51267b258e35a522f8eb776df1a8dd1ad193ccbcf341dd1c4b3da41f31f0039a1e2386f1d0fa365321034e75e2418f5a49e973c1a980f2a6c30be6c095a40a12317
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5d5a5862adf8f4943feae1f9cc201787b
SHA145d350c8bb7644ab6f6387cac2eae9eab08daf71
SHA2564b9b5ad68d4f43bdcd16cb3b94264dcd266b122473bf46f85ae74acb3c041de6
SHA5123399c8bd9569b0ae4894d1db33cd32a10bb4d3c3192dd87f97676e1f3f79de4f46e644c5cb9bea4fe622f711ce00d8c3d9c5c37e5d3a68c574c3de20ac30477a
-
Filesize
108KB
MD5db5a79737587e00e01a2e4674cdce294
SHA15b560b7a4b37e6ddd5a966ba7686aa7954e30eb6
SHA25628838b74a8f86191b966853c72b7717ed7263589c584b95a353b8a67a422c31e
SHA5122095e0a1246117d52df7c5915191b24a4b53b2a6994a74539c5f29de4da348465325b0eebddc5e634143d19a79fe838607069333c6d69254e4d5f5aa8b19d056
-
Filesize
173KB
MD5cc386d8dcca9b4117b04fa01871cf6ea
SHA1f3e48d260ab9ae1d8cd75ae07242b937a2a00b88
SHA256e73917bd0f0230c0b7a90072667a9af8e8b7671d6ad7f202d97c7020fa138318
SHA5129b7ae20a5ce3f88152164e9944ca5db9a71d2ce755b95b7df7fa3ff0d3dc29fc40fcdb7b79979cd27e8a614d253ee59d083acd3da9810b613c9171978de2c44e