hook | 461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74

Analysis

max time kernel
1241299s
max time network
51s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
13-02-2023 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74.apk
Size

3.7MB
MD5

de61a04de576bfedceaf777d00c681e3
SHA1

ad76e12bfafe8e2c837259793a8aa8adc69ad55a
SHA256

461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74
SHA512

eb4b7b68843850e7d9d3e22870f28e5992e2ea3224640388d47180737c970a7fe3481633175d64f176cc281d33cfc8932b1a3a7852fdf98e5ce9d9d92bfa6980
SSDEEP

49152:ZcRgbYP8p8FETgu749/zzgzO4h2YEhs/o1ZIa4zxIOnJMkSWrq3/PHOOK+lMyfsH:ZcRgbYUIfb9rU8YSJ99MKVZRiyfsIMbt

Score

10^/10

hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

http://45.93.201.92:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
banker

Processes:

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv
Acquires the wake lock. 1 IoCs

Processes:

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.odex --compiler-filter=quicken --class-loader-context=&com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

ioc	pid	process
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r	4193	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r	4099	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Reads information about phone network operator.
Removes a system notification. 1 IoCs
evasion

Processes:

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4099

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4193

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index-dir/temp-index
Filesize
48B

MD5
ad8f6e17b2303cfd390985c11bc9c1b5

SHA1
db568ec172b7c4ad375dc71a93b1392bf834e098

SHA256
eee09479020822190252f5da3e54dde16d6685314517d84e33561ee473e9f71d

SHA512
26df1e750e2fc338bb554e5e4549851f59a890151e4671e1492aae4d694ffbe449eaf0ba79f5d41d7c8cd6f11474593944be9f87e596f29ec21b466cf3f6a2ca

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index-dir/temp-index
Filesize
48B

MD5
123c80c2c781a01c7436d348aefcbfe0

SHA1
6f7eb76f66f88f788357fc7892cbd1c2720bf2ec

SHA256
486d3588b783469a9e62ec2ea98b7834c731e93efe58af48b3532025c8f9d96b

SHA512
184113c120cd979ab6812f71974e5d06142db4787fab72e7102efef818a3b467ae1d2a9d16112b1c7f15008f7d899e9b6dc0b16421fbeffd7448d4e4eba76f57

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Web Data
Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Web Data-journal
Filesize
1KB

MD5
449694e8e6e3fefca0c8df30b323b7be

SHA1
47dcc2cce856f64cb81745ff1a1ff52a41cbfc0b

SHA256
668f3eb2e9e9d8efa1d4c06f7a017dd96e95f744c4ed4e02227b85cd1f290a85

SHA512
9e6acbe977c92623da5b10855e79cf39445d97b041e15ed2b0182e2b80c5a7417f9273d92211e4b91e25ff8a91744cf7f005f21241b07ce2d8e8b4383dc1e0c9

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/metrics_guid
Filesize
36B

MD5
60406446f0782c2ad52074adb6b96cf2

SHA1
24408384eb8ab67848a95adcaab2b8e3c4dd55cb

SHA256
a6470fc28238af9255b402668bf022cc6f04c9103e7b385d57f9a503d8674bb7

SHA512
1d86d79b52fa0c269a6ce6a1927e192ba7272c341f30903559f8b446f4ef0edfc92bcf612fe4b4c84b64243b0ff07a0d6983d66d8ae9fb456a7228dada23711b

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-journal
Filesize
524B

MD5
fad1ce6f58bdbca46c1025f6e1b856c1

SHA1
182f88d8d5b176d72d54312ee70d7d93a9b85958

SHA256
74c9f86176e122402a189894c2fb26575afc323cf4aa47ab89d1abb52e7b6cea

SHA512
31eed2d433fc643e0992f61734389459d91f2fdbaf2ded1ffd6e4a972d42a5dec50410a2957fcad244f41881f0271dcb86a2c182c50f4a69151fffdd4da3366f

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-wal
Filesize
173KB

MD5
5f56252016783035bfd69ff1cbafc653

SHA1
7e6b5e92cb1bcb735a40470063f0b33f5910b79d

SHA256
18de0fa4b1a871dfbf1f4a5847d276bc85a5c7aa33e1f8cc75f0494991eb3326

SHA512
5dfc4316661fe175f49e96651a3dbf5c3c2bfb696e918a59c05edfff4e3056ac9806eed983f0fc04f8b2e8d3b55ab0e7eb4fbcb53b42d4a1c94f2032d06420b1

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r
Filesize
2.0MB

MD5
395c37307268e4ad7f9e8ed2ed97da59

SHA1
4ad59de30af9b9e4324f52b55fc404fdcadf5110

SHA256
5fae89e74d46304a76d31c9bd9cbf80366b1597b2c9723b6380f892e0a28a705

SHA512
f71dd0c32896d84d44452df6461eb4a6a179212cfd0bd18fe7ce5e75b5ee7c8c24800cb6b29ffc7c1eeff6564a7537b5fcb96d82fed788cb303b6f098f232afd

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r
Filesize
2.0MB

MD5
e0b52be632be5eb5c1b16f48e7cfc448

SHA1
32abed0e3399d5010a41e022e9bcbe3ddd38456f

SHA256
b43f7231b2f4428f2b38168755f89a8de469925e861c23ab7803c3b23fbb9165

SHA512
72f84075971054f529c676e8685e2fd9cf911e394acf31843b787a77c0d865309489351f4996fc3d742f8c9326be6a62f44d36af164ee0085af10aba84fc9e87

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/gjurkbgk.djff
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/tmp-base.apk.fwrjerw8296927813991617262.t5r
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/multidex.version.xml
Filesize
307B

MD5
78ddb5a6ffd93b7ea4995fe24baecad4

SHA1
afeac544ab9afe20872ea4392cd760e23bad41c2

SHA256
6a242bc8da4d6673fc910f26cb54411497f2e1a958ce4704717bd3a5dc222ffb

SHA512
59d729658fff98095433777f5fb55ba9b09171be768b8ac01370dca2e2d6e9e01e6fcf0a7bdf744ad39add8b540f2dfa4564a502f9a812d70e26d4846b23600c

Download Submit
/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/settings.xml
Filesize
152B

MD5
37a5018377e89fb59b6151daf70723c6

SHA1
9974cd7cb2e9d609e0f32c73d0d026c3bb1dec4f

SHA256
6d18fe3bc31cf6039f7f6ab7ef92fc7f84f1a2266438b29883a45b79025e98b5

SHA512
86483729a5630927b79fdccc36ba036ba8d6095cae174232423ec30fc2c2f3f1748218b5c3c015ef99ba60833b629f933e15b991533cdfe945b2ca02754b086c

Download Submit