hook | 849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5

Analysis

max time kernel
3789971s
max time network
177s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
22-06-2023 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5.apk
Size

2.9MB
MD5

24d1aff4e64ab4975046256cd84f364a
SHA1

87eb2a30eeb048e1a061a4c0c1694284ab0e5f79
SHA256

849d6e94305a096826f95d313f799c7acc95aee57dc1163b7654f0c92b6f5de5
SHA512

8e525f2cb247d73da8e4010e90b9bfac39dccff66a22fd56c893a867bc3aff0c8c937c6fa073c52965a76de3786638503a42ccba97a5c07d463e9f5928d43d3d
SSDEEP

49152:3mg6ICINcBQ4nCnzvMSjjajduVSWrqd/+kog2AsjwPVTxVhApUfmL:3mTDJatkP+dvjw99r3fe

Score

10^/10

hook evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

http://91.215.85.22:3434

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Renames multiple (140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dekezumepome.deyecite
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dekezumepome.deyecite
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dekezumepome.deyecite

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dekezumepome.deyecite

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json	4376	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/oat/x86/CHw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json	4286	com.dekezumepome.deyecite

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.dekezumepome.deyecite

com.dekezumepome.deyecite
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4286
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/oat/x86/CHw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json

Filesize
705KB

MD5
21672f1a63abf2641d367d27ae8a2ef3

SHA1
4d402ab52e8c987bf876a0b8a2e24112032bcc1b

SHA256
e71046d6e6c9657a27f483c55c84762daa544f36d2a98acd118d1ffdcf9fffb5

SHA512
945c9ec8627e657e15eacf4fc804b8ece90fafee5ac5d3611e82e9e2629f4c8d7476bcf3723747812301ef19ab366e10be1b669074e17226c713dc5b56c4988c

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json

Filesize
1.5MB

MD5
c4733b6fae3ef6f2e77a24172bf4e9f1

SHA1
19624390cb460f5fdedf75c1e3eaf8c0091ed2b3

SHA256
31b9e07369af2c7db02483ba77fdda08017ad5789e8887b61dfe10a2a092f842

SHA512
f994584a1113574327f090551eeef35ceea2e1f633ffe85c271bfbf478ed672c7f656b5b9a0c1a3ce531b8e24ebacf7710546240cb20a8a66c54ca1c0f23994f

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/CHw.json

Filesize
1.5MB

MD5
3e37214a8dcb0a66ac8c147b7ab1c0e4

SHA1
9c777385a33bd871dc1d044985b44e673a7a9633

SHA256
8e64678e1b935f9c316d939ba016a1aa6e7b603432ba3b5326c329a2e089ce83

SHA512
877a7ea90ee28e0a293c9ba9996bca8c2f667784436e5ef8ac73486041e5e58331a29e293476359142ab5d74896704d59f543d18ae4aa4db1ddf0170f13e9ae7

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
27b546823c1d5fc9d78136ae121424c5

SHA1
33e20b36a3e70b73b9c6c5c64f75866dd6c8f5b7

SHA256
00eb1b27d7b87663ae46a032e7d7519f8de834979d477c3e5314dac0bad8dbd9

SHA512
d2c4a67537978da3a8de745998094f2ed3364957859c4c16ebe39b7a4de59a9ab797cbfdfe71f273865da15af3d30c2a0646d3b804698b9ba909b62ac09f7cf3

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
3ac422798c71a40aac8e71a17882ef22

SHA1
9150c5320dffb3293d67505deff1e750aa3ae7d4

SHA256
7c0453a5c942bfed94084c77c8e355c192052325d689fec24764649f4adcf1c3

SHA512
d8184b686e239610a5e4aaee5df84572ad4fa918a9654e4937b13d9c39050508738e32b62327b32d5e17eca17bd7ba36a811dddb9cd3551cae7e255ed1b58937

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_webview/Web Data-journal

Filesize
1KB

MD5
c9b3de7ba5d3e6e0e4d19c5e05223779

SHA1
a9c1962a7010f607bd28e9c59a113239071b3f65

SHA256
05bcd6f84da8ed02adcfc49e83fb9acf3492c6651f431a5037bdd3d593f18ba0

SHA512
cad193d4cf0b041aa57da399052046908cd947aaae96593e75108f5c8255387dcc340dc5e1cd44c433540ff728426a48e6a5632107c871b8e835281d5fee9bd1

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_webview/metrics_guid

Filesize
36B

MD5
5b073ab846549035c82b31f6138760b3

SHA1
85f75604b4d75d6f35e4ce0eb893b9cf8609419b

SHA256
7765a1a4879a8b423275083c871739914bb74214ecbde0c3eac0702608d06f03

SHA512
5ed23fc5a1ecdcc0193f0e546893ea260502fa92fe6c35f3ef1c19eae9729ffecf64ccccd74bdeaa1dcef5b56e9a48e111c5c654741a87e88c6375bba8d99e26

Download Submit
/data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
89add3f22e1e4970956fdf35e799949f

SHA1
0faa8c5d046a274b85f15e79f0a7c4e3a178d318

SHA256
aa9b9c74367bf61f7c789d7bea80d47fe3a8fd53c5e40b4e9f1b9b0e185537f9

SHA512
e5a382857724d552a549779334021693cc6b8f97dc482a48697233375242a1ededd5dc98cd1190dde573fa3ce5d28fa08558b42ca35617b12a6ae7900966016f

Download Submit
/data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
932da6b090b4bc996c6b95e049ecb878

SHA1
d4b49f159fa78663e504c2908f4e34141352c78b

SHA256
8ed8c8c2eb8a7d505868a49400d9f38538ffc2d090f9223adabc2aa3e745caef

SHA512
4fc6474a0a8ae36257c3aae19b60a5ec051fc21cf31dd510bddd2a1d61260c9fd5d0f8b4fd20b2dbe638c5468b40310fb2af1119476f40cbcd9a1176404b7bb0

Download Submit
/data/user/0/com.dekezumepome.deyecite/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.dekezumepome.deyecite/shared_prefs/settings.xml

Filesize
138B

MD5
f8bdc04912eb3db8c209c12532aa4591

SHA1
02a8902131d9156b4ec30974580ad083b7d52a84

SHA256
b975dd690c4028dba6fbf2faf0e940d46ea0dc458acbc24eafe74e9d5b75d19a

SHA512
08aa271eb341ba240b088f2209c387d3f8796956a6220ddab34824e251fc33c691db70144710146a9e05675e7354d1b070727d4a76aa3f88b71aad233ebb1101

Download Submit