Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
29/03/2025, 22:02
General
-
Target
be966b008996fca884ab269a1f843007a82f38e24511c52ed63a3e69ac5deb8a.apk
-
Size
1.1MB
-
MD5
5aa447ebaab3b41a4882cb0ac6702a19
-
SHA1
2099fa70fdaa308562b0a20890e5e0f0d590960b
-
SHA256
be966b008996fca884ab269a1f843007a82f38e24511c52ed63a3e69ac5deb8a
-
SHA512
183a8cae6ae7bdd1a3d22097a8d761880215cc43f291f380d8c6588f7c91c70807d585f9b5c955a0d13155bb2fea61709cfed5add7b7473c965be68dc5287a80
-
SSDEEP
24576:O/yauz49i54KJtkDhg2coT0zMGlY+U/ouykSg/szPY:O/Rj955UY5SYj/mkSg/qY
Malware Config
Extracted
hook
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.vutuzaxejizi.kolehu1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD527773f9db729d070503bc316a4db1469
SHA18472c2d027c03d29eed9683418ec049efa81b94b
SHA2561c283ac7111565b3c4c9bc2aac9b3186a7d57c63e8c11007aaa0db989efd7520
SHA5125b9079db6d9c0248ec6f718c00a9f5ab1c29f9c17414bdbf81b6687cb1b76d0d2fb7c646ca562da3e975249254e75031c089b2456550c17d5f9b48b001ab6154
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5db5ad75b48531dc472ff8f1a9ba9c536
SHA1eb3319e33b6af4020a26fcaea76cec2d226283fa
SHA2565bf4b945c44681ebe936c9eb47e0171ecae8bb0e132446fc83899c7d93a8705e
SHA512624b1e7cb80d51a1774f996fa8531c0e909786942ae2930a0ec880df2aec6bd3972923083e924900399b1fd11f04d694a40288f13e2430aa30c086071783df8a
-
Filesize
108KB
MD507d4bb6136193c802f9b42e1b3bae22e
SHA16fcd8e8449dfedb29b3937fa5b5a7ea7145032b3
SHA256f2b0bb20c9d64284506871202a47a8f8a2eeb3ba4494827d0c6145e6ef17da92
SHA512606e13a76978ccf8605d9122ca6c83dc215fa4f1ffe3bca94da90ddbb9912c3a2f156ea2eb68aece9ce740b80b54734f0ed99a118e498e29625d894f452a8e37
-
Filesize
173KB
MD5780c94b27a9cbf456344b30ce29b984d
SHA1f914e58fa84bc3bcf39a5235d93645cd080ad219
SHA2561647f506f21afacc8537ebee0d5f64bc5a7e39a9b4bec4bc049227ce3fe88cc2
SHA5120f131b5e0da836f7ca1c04c4e4b1a44fc8ddcf7810fb4be6f865ebff045536172682a1e5f41ba2c10aae238a9d604e97edc9997ab79d477f6e650442f8926aec