hook | 238cdfbab88cbcb6b1a2379b2a18c993640c1f498c4cb0e9faef408331f41c0b

Analysis

max time kernel
790829s
max time network
158s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
18/05/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

238cdfbab88cbcb6b1a2379b2a18c993640c1f498c4cb0e9faef408331f41c0b.apk
Size

3.7MB
MD5

10f5a518febd8b0b08b7f69982bc0a7d
SHA1

77137ca4881b82a9baf3dea99e03ce92c89cc742
SHA256

238cdfbab88cbcb6b1a2379b2a18c993640c1f498c4cb0e9faef408331f41c0b
SHA512

52c557425b2eff4f244c2c34280118e913574c0b3a51bff966c4fb4538afdc1220ad6f94956098aeb53cee4984aeff30142f148f6e19c1a978af6d0e7801f918
SSDEEP

98304:z/Se3GAtk9/CYItyoKmFTwgzOOH2qWS9Rr:+e33tcPItTvFcg5W6b

Score

10^/10

hook evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

http://193.233.196.2:3434

Extracted

Family

hook

http://193.233.196.2:3434

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Renames multiple (140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dogilowopuna.zico
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dogilowopuna.zico
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dogilowopuna.zico

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dogilowopuna.zico

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json	4118	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/oat/x86/pskPXGY.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json	4090	com.dogilowopuna.zico

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.dogilowopuna.zico

com.dogilowopuna.zico
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4090
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/oat/x86/pskPXGY.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4118

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json

Filesize
704KB

MD5
9bfea1b2027ec1635c3590e0ea14e3cf

SHA1
9cc1ea7f49e361961be1f5d2ab43658d41f86d59

SHA256
f2620b302348120f00c9bd7a3e0a6cbef991b484edcdcdd915fbbd13ac861eb4

SHA512
4e17d67bcd5f5361a3d9b27f4fbc29969b25a2686edffa9872e7bca1a6528b4eaaf7f90541eda8d31583d8e515b1a20d4d1b20dd4a88c9e83e07d91d525de4a1

Download Submit
/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json

Filesize
1.5MB

MD5
7ffa71e1e1ae0b4b47d6be864fc29366

SHA1
8f19d6ff1a28b1737f298a22c19009782ef84331

SHA256
593b12a640d78ee06f6b74458c7f456eaff676b68dca095de5feeb86adeae18e

SHA512
f017f92ccbb379f7fae44df3473c12b03200081263c9f5187b929db49887f4af0498f46697cb51cfab0901f5b04c133f10b7d7b2291a8832a9e7f1b9082f5d9d

Download Submit
/data/user/0/com.dogilowopuna.zico/app_DynamicOptDex/pskPXGY.json

Filesize
1.5MB

MD5
cf80a0964d7adb2dc9ab389185abcff1

SHA1
a630b6d63b9be79f2fe9f2fc38c91fcbc1d8d6ea

SHA256
f90f95cb686db2f9ce0607038438527e3665ca8e33c38fd168834f6d96def4ed

SHA512
ef1a6f7c47772fd49ae2fda552df4f54fea83e30c99980ae8e0863b4abcfe2d7cb9869449962129cb560760d49ee6349add36e6ca7417e6cf0e9f99d86a3ee53

Download Submit
/data/user/0/com.dogilowopuna.zico/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.dogilowopuna.zico/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
a169a52f069ad0f61f9f0c1faa5ea501

SHA1
90a84687905e5088bc8d3584da55cda90b793350

SHA256
1aad0bea76588bacd3cb48bb05516fbee1b5ea2db5307d6b5c20d3f65502161a

SHA512
3fe9e925940d6ed2a9800bde9d620bd8dcf3adca3990e22aeaef86ea33f0fea2458bf021d90500aad1f218dcc273f88c4811e7992b124c4d6154b562c3b8d493

Download Submit
/data/user/0/com.dogilowopuna.zico/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f016be31126fdc42014531dbcbcf5f5e

SHA1
a4390748828aa5c35302b765d1f032b8b595408e

SHA256
4f31bbc3be0d5f45bac63f0ddf919164dc2027d702c5a39387f74ad7e3c96d22

SHA512
d469bb940c679665c8b938ff6ee4c8374068f839b68c63ac7f340f906b307c25b9fc3f517639d24888c23c105e0f2d95017076a4b705c2c29948e6f332f72316

Download Submit
/data/user/0/com.dogilowopuna.zico/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.dogilowopuna.zico/app_webview/Web Data-journal

Filesize
1KB

MD5
4be235bbf7f5471cb7ff98eaa3432b5b

SHA1
4fb0f90173400e3cfa5bbfd4b4e2634c04359c7b

SHA256
9277d3b1174c86f7a006480a44ecc36203decfbbef8732eb0fa9465b98a5d2ea

SHA512
489a596ab90025d332c3a832cf9b9570ac218930f56574004c430adb0ca53299e44412c6d64081305b5e3830226a21bee19aba4734ff6447555b75b52e481da9

Download Submit
/data/user/0/com.dogilowopuna.zico/app_webview/metrics_guid

Filesize
36B

MD5
2c15c1fa08c1a3a33c1d7e5c0a5f12ad

SHA1
ea30e5d490fe937abf0e77adaa0af473ecbd09e7

SHA256
0d33f380823615a9371cff8929e47e8313f8c922b095dc3b17d55bb76c9e1f54

SHA512
ab35ece6820fade2e5a12ebc6f1dad3c7d48650b473bfb60762b6b0d2ef02dc8bbfb9f77e73e0ce377f883809f7312593dd7495f8e678d7adc428d826e0e9827

Download Submit
/data/user/0/com.dogilowopuna.zico/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.dogilowopuna.zico/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
b4f0ef4eddef5a0966e065c3db39d0f4

SHA1
b8132fa6facee35c28598bf077e63dd491c8c978

SHA256
d0101f6de48a4313bc15491fba57ab39aeac0afdd983ede134b3848b97177428

SHA512
0f408e3ce56a255b6bd71dddc2c904ec5780d41d95144cca32b2a47c96f3f656efeebe2ee4d0ba09fb2e3bb96e6baeba07b4af69569da1c87f276a1ee3655bee

Download Submit
/data/user/0/com.dogilowopuna.zico/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.dogilowopuna.zico/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
9f7510c12c976aedba4ee2eaa4ec4ef9

SHA1
4fb9b8a3a6d007ff7db07ae1404b77a227b2e918

SHA256
d4c9dc3199c56417bed9576bdd86f152a4f4211270e7b3a60922c56ca9121a22

SHA512
fe6cf2f3fb8507361ea2f1bd14c6851faf941c8e0aa5847528bd03d458b992a02d0bbb3f89e1db06db12c30e13e70d695e190117b41ea3dfa173adbe1856a59f

Download Submit
/data/user/0/com.dogilowopuna.zico/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.dogilowopuna.zico/shared_prefs/settings.xml

Filesize
134B

MD5
78a2c63a0ec2f947097c8b764fb49e30

SHA1
e38dcf9d6a39c0f58cdabfcbd5dd4954817a7869

SHA256
7aaf74896c69acb15d2b36290e8bc74f6090e1b51ceab19400018fa7ed87285b

SHA512
96acd80ce5b0a1bd286f688de13b8b5ed9f2cfc73f034c2928a3d7a360a100e54c7a3239a45d7f81969585cc40b6fa9ab3ec4f7fa487e49efb1954b14d66484b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads