hook | 5ee21b2ad8525277035379d8c96e9aade1b6cc2f41e4877380033c00e8710686

General

Target

Test-GoldenCrypt_1.apk
Size

3.7MB
MD5

ad1c9280e2720887e64602d87a1cf122
SHA1

672014038e4aea7eeeafbc289b7538e887ab96fe
SHA256

5ee21b2ad8525277035379d8c96e9aade1b6cc2f41e4877380033c00e8710686
SHA512

dbf91c21f717e04eabea4eda52329691354cedd049a90839f443e2ad5b69d0b0db92106cd0ae14bec4c268daed5766993a50d6b965eee66ef11f3ea0e6929395
SSDEEP

49152:zX6Zo1QPKzvMSjjajd3q/mZ0SWrqf/5uVuM7aaDUm3QBe7kkT/ZjmPsT+9HLisxC:zXkkGstkU/CpsVuM+at3Qo7PThj+EV

Score

10^/10

hook banker infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

C2

http://5.42.199.22:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.gegukivoyekugu.wixaso
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.gegukivoyekugu.wixaso
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.gegukivoyekugu.wixaso

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.gegukivoyekugu.wixaso

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gegukivoyekugu.wixaso

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json	4169	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/oat/x86/araS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json	4118	com.gegukivoyekugu.wixaso

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gegukivoyekugu.wixaso

com.gegukivoyekugu.wixaso
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4118
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/oat/x86/araS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4169

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json

Filesize
699KB

MD5
07824c8073ab4868f99ab51ce39bdfdd

SHA1
e18b345372143ab2d5c83450f9a908fcc5d3c0d7

SHA256
60a661ad13e5a77b9e88abb4efb24043a3c94eddd0dcdf5631693d5c8fd24dc0

SHA512
7d6dbb9403e7bb0c0e8583b65b0d19eb732387cb60a08a96fb8f6ca873a335780fc25992d3f47598e6514af324baa01085ec2979b02c460662a4a74f2eee518c

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json

Filesize
1.5MB

MD5
dd3543ea25a6ff281007ce4fd893e25c

SHA1
e817cf7635c9f446c9e5b18728ce2ada5dcbf92c

SHA256
6a907197aff282aed241a69a7d8215e9c7e07ba03749d6ad6b210c343655ebc7

SHA512
6b09bf55d8d33bff39e303c48cb0d18b98332db61bce1a61d581ecac9ae6448145cac709c143db872468d33ab4d4320852c2144b1311e7b2e90688ed2623042d

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json

Filesize
1.5MB

MD5
f9ce162ab0df7c1c60cb716339a3e12f

SHA1
554d6763c2b491ff0a073f7b585ff065504b870f

SHA256
b4ac77d28f07eedbe7b91642e7d5f6f3a2f0e0194a19a6dd268223a4c5a092bb

SHA512
935fb3461ca1ff87f04d2cea5b4a59cadd44c0d33373ecee4bc3a87d4f6fead4d1de4a6ac356cdaf9f08eb8f6c610349b154f60f9c4c1b31bac58329bb47fa43

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
59d9e4708777b137d786e448fc82c22b

SHA1
1f5f363f4a0d4f4015effaa58f265be49a93b285

SHA256
ea8d8d3d9067a1cc4fa78c6433064b2517aba6418442f229bc74beed6e274601

SHA512
bb5a7426d5d86f990211c83ffe2220c5aaa8a6cb9edd8e7c9e8d640e0d56e72535083bbee8d2a902f513cd762e2652d08c4aeaf7cd262a2226677f34bd18e4ad

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
32838ebe7cd8c5f903a4aedd7a9e10bb

SHA1
5672b58ce1ed29db8e9186a37997b82e89af95e9

SHA256
5dc02cea38be7ff2c606a8128127add24132a95e2fbfdd17c5bef6787086e670

SHA512
4deb4c1829d2cdf42524f79de658e421f8750fd43b7ccfc4c9e68ee64da077782551b851553d5bc49ad116e22513f0351976555870a31413d12a4489b955fed1

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/shared_prefs/settings.xml

Filesize
138B

MD5
f8240e8ed3ba59cad5acf6fcc80dff15

SHA1
2b47af7b8cc98c79da83391241fa176a0c721cce

SHA256
3a7084997e2f1b95da90a2ae3b2cd19d8d2c310c6e3b7dfebb14c934a3cfb867

SHA512
06625d2489061732245aa21b802707c5b9fb6827c98bf9205a2615633b938cd4e053fa85ca789d6dae8d5d386c82b85002040f834018d24734dcbeb0ab7d7677

Download Submit

Analysis

Sharing