General
-
Target
e6c0ef7ef87316d2c02b1a41fcc307b6bbbb2c3c60b2d8b99b4dbe213326403e.bin
-
Size
4.3MB
-
Sample
240625-1xh4taycrj
-
MD5
780f3edda0e071dee63f15abf5f3efe0
-
SHA1
6f629dfbfd68da33574c8a3061c80524dea5aebd
-
SHA256
e6c0ef7ef87316d2c02b1a41fcc307b6bbbb2c3c60b2d8b99b4dbe213326403e
-
SHA512
d29494e07f5bd74c64b7d04da160b77061fc1896329db9d41a3d9213924faa4b7fce4c15babde64506a34c32c4ca9d81c1ae436fc2df31d9ad22e81ad1794272
-
SSDEEP
98304:Ta5ycL4AoFzwVNg4RLWtMnVyD7vbneGp4ihH1w3UItfK0BDgFal:+5zJ+8VNPLtnQnvbeGp/hVwkItCEl
Malware Config
Extracted
hook
http://1
Targets
-
-
Target
e6c0ef7ef87316d2c02b1a41fcc307b6bbbb2c3c60b2d8b99b4dbe213326403e.bin
-
Size
4.3MB
-
MD5
780f3edda0e071dee63f15abf5f3efe0
-
SHA1
6f629dfbfd68da33574c8a3061c80524dea5aebd
-
SHA256
e6c0ef7ef87316d2c02b1a41fcc307b6bbbb2c3c60b2d8b99b4dbe213326403e
-
SHA512
d29494e07f5bd74c64b7d04da160b77061fc1896329db9d41a3d9213924faa4b7fce4c15babde64506a34c32c4ca9d81c1ae436fc2df31d9ad22e81ad1794272
-
SSDEEP
98304:Ta5ycL4AoFzwVNg4RLWtMnVyD7vbneGp4ihH1w3UItfK0BDgFal:+5zJ+8VNPLtnQnvbeGp/hVwkItCEl
Score1/10 -
-
-
Target
childapp.apk
-
Size
2.8MB
-
MD5
114bf0d5c6c6eefa3549ba6258485dd9
-
SHA1
5ec88f000c78dbe85cf6e807e8ec28d144469bf8
-
SHA256
1aa526105b85cad2400df93b3e30c53c5be4982ccde416bd8dc23a3dc2f7e0f5
-
SHA512
5104c5b381c4e78273d3b9a6a427bd883588f24212352f75589418cdd8d5875f4482618ea300eda8900cbd16ab60c887451199fd5a24a3785facf9dc82057bad
-
SSDEEP
49152:rKb7U+Oou2DyWx4UgDdaHnevfxrtDAK8FbQC1R9/oHzfv24R3hag0gK/Xx4g/ku:Z+OmiU+SevbD+bb/oz105Xou
Score10/10-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Removes its main activity from the application launcher
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Requests enabling of the accessibility settings.
-