General

  • Target

    9073568a1855141fa0de08a35fb37216b8571bd92cc45a564af2d787e8924aca.bin

  • Size

    3.9MB

  • Sample

    240614-11214a1hjj

  • MD5

    c4c311915dd408fac880507dfb257742

  • SHA1

    d94dd0f7f95254eb7fc0be983007c136a56c9684

  • SHA256

    9073568a1855141fa0de08a35fb37216b8571bd92cc45a564af2d787e8924aca

  • SHA512

    25a2723ea4a8e8d0a8dc9a7bce5b099ba97809de286313bd77869b89a42042b2f8ac50f95542afc94ea2d2e9b0ad9e22105b46ed6fc428fa53b140191035fd9d

  • SSDEEP

    98304:sFOWOm3i/0E6/LkCwGG4ZJ8a96F8UJ3SCLaaiNS6:sMPQFTgGG4R90DJ3WNH

Malware Config

Extracted

Family

hook

C2

https://ws.lookonstars.tech

AES_key

Targets

    • Target

      9073568a1855141fa0de08a35fb37216b8571bd92cc45a564af2d787e8924aca.bin

    • Size

      3.9MB

    • MD5

      c4c311915dd408fac880507dfb257742

    • SHA1

      d94dd0f7f95254eb7fc0be983007c136a56c9684

    • SHA256

      9073568a1855141fa0de08a35fb37216b8571bd92cc45a564af2d787e8924aca

    • SHA512

      25a2723ea4a8e8d0a8dc9a7bce5b099ba97809de286313bd77869b89a42042b2f8ac50f95542afc94ea2d2e9b0ad9e22105b46ed6fc428fa53b140191035fd9d

    • SSDEEP

      98304:sFOWOm3i/0E6/LkCwGG4ZJ8a96F8UJ3SCLaaiNS6:sMPQFTgGG4R90DJ3WNH

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks