hook | 5ee21b2ad8525277035379d8c96e9aade1b6cc2f41e4877380033c00e8710686

Analysis

max time kernel
516029s
max time network
35s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
05-02-2023 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test-GoldenCrypt_1.apk
Size

3.7MB
MD5

ad1c9280e2720887e64602d87a1cf122
SHA1

672014038e4aea7eeeafbc289b7538e887ab96fe
SHA256

5ee21b2ad8525277035379d8c96e9aade1b6cc2f41e4877380033c00e8710686
SHA512

dbf91c21f717e04eabea4eda52329691354cedd049a90839f443e2ad5b69d0b0db92106cd0ae14bec4c268daed5766993a50d6b965eee66ef11f3ea0e6929395
SSDEEP

49152:zX6Zo1QPKzvMSjjajd3q/mZ0SWrqf/5uVuM7aaDUm3QBe7kkT/ZjmPsT+9HLisxC:zXkkGstkU/CpsVuM+at3Qo7PThj+EV

Score

10^/10

hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

http://5.42.199.22:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.gegukivoyekugu.wixaso
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.gegukivoyekugu.wixaso
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.gegukivoyekugu.wixaso

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.gegukivoyekugu.wixaso

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gegukivoyekugu.wixaso

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json	4167	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/oat/x86/araS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json	4115	com.gegukivoyekugu.wixaso

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.gegukivoyekugu.wixaso

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gegukivoyekugu.wixaso

com.gegukivoyekugu.wixaso
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4115
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/oat/x86/araS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4167

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json

Filesize
699KB

MD5
07824c8073ab4868f99ab51ce39bdfdd

SHA1
e18b345372143ab2d5c83450f9a908fcc5d3c0d7

SHA256
60a661ad13e5a77b9e88abb4efb24043a3c94eddd0dcdf5631693d5c8fd24dc0

SHA512
7d6dbb9403e7bb0c0e8583b65b0d19eb732387cb60a08a96fb8f6ca873a335780fc25992d3f47598e6514af324baa01085ec2979b02c460662a4a74f2eee518c

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json

Filesize
1.5MB

MD5
dd3543ea25a6ff281007ce4fd893e25c

SHA1
e817cf7635c9f446c9e5b18728ce2ada5dcbf92c

SHA256
6a907197aff282aed241a69a7d8215e9c7e07ba03749d6ad6b210c343655ebc7

SHA512
6b09bf55d8d33bff39e303c48cb0d18b98332db61bce1a61d581ecac9ae6448145cac709c143db872468d33ab4d4320852c2144b1311e7b2e90688ed2623042d

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_DynamicOptDex/araS.json

Filesize
1.5MB

MD5
f9ce162ab0df7c1c60cb716339a3e12f

SHA1
554d6763c2b491ff0a073f7b585ff065504b870f

SHA256
b4ac77d28f07eedbe7b91642e7d5f6f3a2f0e0194a19a6dd268223a4c5a092bb

SHA512
935fb3461ca1ff87f04d2cea5b4a59cadd44c0d33373ecee4bc3a87d4f6fead4d1de4a6ac356cdaf9f08eb8f6c610349b154f60f9c4c1b31bac58329bb47fa43

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
674ad173b9a557a112a3028358cc7eb7

SHA1
69a1e8d37571ec29083285b74063b2e556daec7f

SHA256
0e1133bfe7b75eb8e939238837cb7fb9d43d226cb454b57ead7a92d0de2b596e

SHA512
1e3dfae061ee7052c2c9a157f097c9b5af49b8a95ba339d61a42ecc004347db9a464ae06e8eb28bcff6e9aac7d313340c6085c1cf6b81f174b474d2a319fb94f

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
7309277a208b52e68d024c69c591d61e

SHA1
113413f15ac820a70961c6439d7bfa2ae22e827f

SHA256
f97435c012ee695ab4725f76c4d6111c04667f5d4a9019849000f013cca1176f

SHA512
88fd157b3894a938ba9da92ed3d3fd2ac2c827208c32de1ca22971cc672845c64986489f460933e1ee3f4902e45b75aad67756cbbfd4f870da051adf22792a07

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_webview/Web Data-journal

Filesize
1KB

MD5
af16482565359abf8e80fa9c6d4edfd9

SHA1
a6be0bdd7746c32e2078fd3879b5ccf6751df4ca

SHA256
7f8954cc6a010d445ba3c4f90965b5aa3374c227193c831d1e74f89c84853fbf

SHA512
51a8f5e607bc14eda245831b887dd3c457f1b3744ba5106e0af180c1938b843ec1a028acf60ed2dc5d80cf1f2ba1fde7d43dfd0e663b85ab6e504164b36b8c9e

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/app_webview/metrics_guid

Filesize
36B

MD5
ad1cf411fabf29a7be94fa2c7100873a

SHA1
16de0d93e88acfa1e3f5fab99c99e57ae8b70050

SHA256
ceff04c6018bad656ec93b2f7aaa3ed2eb45324a34890d4cfd1b3018b7d23720

SHA512
2f84d7ab2cce8a157d94d5d806a94a7117142508a3ed6d51204ae7c89f69de951710881359b9c6f5bc3e112dfe38056b17f29c1aa1cbe9ece81bb4e258a118ce

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/eeb205d44f74f948_0

Filesize
259B

MD5
7a92d8dd67ad13bd48eb84650a2f68a6

SHA1
f23bae6bf50a359cac7d0118027040fe566a5f2b

SHA256
87ea61d7f5d80376ee66a2b7bd7694a5979631c1cfcef4a85b76ce4887bbaf9c

SHA512
770fe453ce9211149f9808817bceebc45cfa5772a30cddd150746ba2be053f70263550e777557a81116c0dac03ad2e180303e1b4078e9c8f17510357f6749233

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/eeb205d44f74f948_0

Filesize
259B

MD5
7a92d8dd67ad13bd48eb84650a2f68a6

SHA1
f23bae6bf50a359cac7d0118027040fe566a5f2b

SHA256
87ea61d7f5d80376ee66a2b7bd7694a5979631c1cfcef4a85b76ce4887bbaf9c

SHA512
770fe453ce9211149f9808817bceebc45cfa5772a30cddd150746ba2be053f70263550e777557a81116c0dac03ad2e180303e1b4078e9c8f17510357f6749233

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
168B

MD5
0d1cf9e71496af9e457ebae74aacd358

SHA1
6ad452124435b721df81f63f3cd1d7c4473961fd

SHA256
910cb54b09940707c6c7c17a7f221f78cba2bafc6c5c490c0795b6f6e48d0f56

SHA512
5c277c1e226ebd98409c0ff23693ecfc2e0b8c70cafa90bd8d6c63c6bec316bc3ecbee55618fde42c5e0ffa246e0fe81da95155bd9745fa795c1bb77478b9237

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
dc4efe92dada75594953defe16484687

SHA1
fc9154adc052821fc7c7ae7b649a11a7e31a6b47

SHA256
4e9a37fbf26db4984ea6385d197f7dd88795d080e5b0d65e2ee5335fa28ace3e

SHA512
6e42650c7075f855244bd3f0ed83fb5249246f2254ec1ae53a709773427b5796d3c5e8be161465d12c23f49059661a9d054e931f840b4df8161cb2f0f990c4ef

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
6f8853ccb0036abae5c36d7c92a27124

SHA1
36953246f1fc65d5c8175a68aaadadc7d38627a8

SHA256
bc783d8d9a95c9c0886a17d8aa21bd2a9d0bfd4174e29bcd7ba4591154289c63

SHA512
6d68efc8614173b9e1dad5032e318f9cd919159496f5ee277ebe35ea3ac8e6930a800e6f04a750d6c6063acc8ca40f4a3e1f58a3557bc09a9589db812fb56b6d

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.gegukivoyekugu.wixaso/shared_prefs/settings.xml

Filesize
138B

MD5
f8240e8ed3ba59cad5acf6fcc80dff15

SHA1
2b47af7b8cc98c79da83391241fa176a0c721cce

SHA256
3a7084997e2f1b95da90a2ae3b2cd19d8d2c310c6e3b7dfebb14c934a3cfb867

SHA512
06625d2489061732245aa21b802707c5b9fb6827c98bf9205a2615633b938cd4e053fa85ca789d6dae8d5d386c82b85002040f834018d24734dcbeb0ab7d7677

Download Submit