General
-
Target
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b.bin
-
Size
1.1MB
-
Sample
250414-1xx8qsyvdv
-
MD5
1b28003eff4d3015d0302537bcd2e828
-
SHA1
9cad8fe7bdfe2614a8d16dd6a480f943d050aad3
-
SHA256
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b
-
SHA512
43f42f1a99bd1896aec8dbadbc207aad4e4d6e616385d7cde154b836e80fc78ba7bb4d47c6ce6424e14aee289ecbdad7cb8702426068c874012789f69e03f2c8
-
SSDEEP
24576:avwyq/ik8ZQIXmyQ9daAuVTME0ugd8m6XdrU/o3yi2g/BchN:avwR786Igi7NXe//i2g/cN
Behavioral task
behavioral1
Sample
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b.apk
Resource
android-x64-arm64-20240910-en
Malware Config
Targets
-
-
Target
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b.bin
-
Size
1.1MB
-
MD5
1b28003eff4d3015d0302537bcd2e828
-
SHA1
9cad8fe7bdfe2614a8d16dd6a480f943d050aad3
-
SHA256
39d8f34b85ee1bb3a164ae8181af0130579480317e2e449186043caf125a7b9b
-
SHA512
43f42f1a99bd1896aec8dbadbc207aad4e4d6e616385d7cde154b836e80fc78ba7bb4d47c6ce6424e14aee289ecbdad7cb8702426068c874012789f69e03f2c8
-
SSDEEP
24576:avwyq/ik8ZQIXmyQ9daAuVTME0ugd8m6XdrU/o3yi2g/BchN:avwR786Igi7NXe//i2g/cN
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Requests enabling of the accessibility settings.
-
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Process Discovery
1System Network Configuration Discovery
3System Network Connections Discovery
1