hook | e4fc786d2c691c5e735db758881b9f7a455148615a4bc140ba286a1caab4254f

Resubmissions

29/03/2023, 00:17

230329-alflfafg2s 10

27/03/2023, 10:02

230327-l3abjacg95 10

Analysis

max time kernel
579321s
max time network
158s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
27/03/2023, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YouTube_obf.apk
Size

2.6MB
MD5

9a04cd4b51e74d6951c2c7f78cb0b7bd
SHA1

791880e2417efebdec3bb56c66d9ac18e32c96d1
SHA256

e4fc786d2c691c5e735db758881b9f7a455148615a4bc140ba286a1caab4254f
SHA512

add5a5cca243b1260cdb635d18ca0addaec009f32ca6fbef5e6a8c3debe92c65fc35ed78bc40f6efd1eba6bb004976b7242385613ffe290e5789765456d65947
SSDEEP

49152:5G+mYa9G5wqCZhjz6UYSWrqWZJ/9h0D/Yw36O8RJtnkats10N4NIJ:5GYa9G2VGUs9eb8RLnt54NIJ

Score

10^/10

hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

http://176.100.42.11:3434

Extracted

Family

hook

http://176.100.42.11:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cinecaluxozixu.benama
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cinecaluxozixu.benama
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cinecaluxozixu.benama

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.cinecaluxozixu.benama

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cinecaluxozixu.benama

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json	4173	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/oat/x86/ODNGfSF.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json	4100	com.cinecaluxozixu.benama

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.cinecaluxozixu.benama

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cinecaluxozixu.benama

com.cinecaluxozixu.benama
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4100
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/oat/x86/ODNGfSF.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4173

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json

Filesize
704KB

MD5
6d5e9bcdab546a41a32dc134a0ca23e1

SHA1
272c6afdaebbf7a6bb78f42f659d5806b30a6907

SHA256
1a80d8632f0dc7d62711f32af196dd4ed98654453bc261288dc52c164f086071

SHA512
54d31460ce8dd7b0616000bbb6ecbcd49860583b08578af5023bbbdf91705de04cd51ee7d919eaf56b40b6acac0f30df05921c5254dbdbfb1e5ec68c42c17ac3

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json

Filesize
1.5MB

MD5
2f014c008012e9eb8c1d2ad8cd3bc0cc

SHA1
b131858e915215e3d0f9c8c0a863b74289f1b9ac

SHA256
5d47e9802a60d0c0f374be499c0a6c4e52cda4b21cf202f0c5cfeb962ae3ead2

SHA512
8e4928abbd70451e9fd7bf8027abc93c0c0ad23d0eef1cc728e8c36c30c5d8288580821583e887cac0d5f79316bbf2fd5645c4079480362996ddbe34405ad7ae

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_DynamicOptDex/ODNGfSF.json

Filesize
1.5MB

MD5
089544070959213580514e7b1587508e

SHA1
2e65d6a4b733fac241243dcbb3f45924358fa263

SHA256
204e9b3006016eae2c3b6323483c02515a158e722bf205571ec576e25d52b4e4

SHA512
f398f8ebcdfd628ca78fd17d74c9b72932987d81a94d2db8aceea692e274f6a9b7df751ff73b69526e87f6e379f1f412235ecdd8c72de7d51b3e44e8ec8192f0

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
cd3efb03f0aa03286d35a483abea130e

SHA1
a540f3be195fb4fcbbad68fe9ca2d8c5c4b8f9f5

SHA256
5de1aee754c2e17c4cafdd7d1e17e28c844b86582fe2ab99207dd7478f1b7404

SHA512
2c5f59c1e957692c3650d198807748a29c0d48da99a7cf1de330bee621bd8312a3e20716d36b7686e62c351073e23544c3c911eea465f4995df63ae66ec8ea72

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
d9630d966230caaa1613db5f6f7058d2

SHA1
a5cf66b142cf70143824127056b756069e581165

SHA256
c4f8dbc0f2575dddb1abcd5cd477a869bdee3efd453119244426124fc6edccf8

SHA512
199615764f2f88d91fd4fc4551cfb9df5e6dc1df1652b3dd9a1a21175aa759e8c69e91c2b98c424ef60695aecf271af256f468a3bf300ae474822e9475628aaa

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_webview/Web Data-journal

Filesize
1KB

MD5
a0e6c409938cb40d34e41b5f280ad180

SHA1
f2495dff19a234ed247405db5759d39207c38e32

SHA256
255b0cf2df83147add9abbe168b0f474d3ef297458e3e4a65e2e2d263bc9701d

SHA512
ec881c599bfda2d5237620e91f7b496f887b9585434f92c28102c092d67454d8ddc39059afd6d164d623d9f4263a0455e356270f007334ad39ba599edd044859

Download Submit
/data/user/0/com.cinecaluxozixu.benama/app_webview/metrics_guid

Filesize
36B

MD5
7defc30bbb075163bec34906d17da98d

SHA1
a66485d09c5137bfcf73c542eb68da0bb851334b

SHA256
4fdae3a3449f630616f58a01c3c7fa552d4a969d5d8fd013fd9577e66bfbc4cd

SHA512
224853b4c2f12b2ca967b7a4b1a40c0768e59cf9396e10631bcd6f1f2aa71c7c706b8e7eecf61d2dd10eba54199cb2c6fdaa760ee6c9d1654378cc8027a9b5f8

Download Submit
/data/user/0/com.cinecaluxozixu.benama/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.cinecaluxozixu.benama/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
696c30746a979a06139220da83642272

SHA1
0a30398c214df317b9be7b0d76df5654999a5b7b

SHA256
a23857fbd0ce016bd74ea87d6899695dc312ac4c796cca0726effe23ef7a75f5

SHA512
c9a31d30ae900e422b7df6e90a7ee4541672663d743113037607bb83eab151e6fbdcc2d9f85028286144ec54797cac19bb8ed96fb19281996875b975f953a32d

Download Submit
/data/user/0/com.cinecaluxozixu.benama/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.cinecaluxozixu.benama/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
5c2dc0644758c5dd1b700fa94b6493fb

SHA1
0508d4245306921fc5a3a89f53c30a3c675d37d2

SHA256
65c1c49e6f8b2b40c91bde4a2281dec190d596c3dc8f6be06debe1dfd4757fe9

SHA512
570f07e5723b6779851fb9d9c3728486796803731469e2c0c2335a74106dd77f30dbaa01e00a29e6173255494fbbc6b6faa8ed481cfe9c29bb5f66c14fd1e7cd

Download Submit
/data/user/0/com.cinecaluxozixu.benama/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.cinecaluxozixu.benama/shared_prefs/settings.xml

Filesize
138B

MD5
7ceae0a9d45f1c82277d4a61b25e06fd

SHA1
d50d12087085a2a4022ab438544ff5cb21b877d9

SHA256
546f08d3ef03531c006fbe4271232b5d3056da72465664a8363bb1411fa1e147

SHA512
043b7f77726684a39dd67340a2e1e2cbc3fe101acf088d8acc0220e7a1d4cdef48232cd613c59057c7ed717a631a0e09766995c2f8f755887a53c411b2fa2800

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads