hook | 7f86778b11adc997df2d943f889cceb90bf7e1f48520e95fad2fc87c66a6e825

Analysis

max time kernel
1759169s
max time network
160s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
25-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f86778b11adc997df2d943f889cceb90bf7e1f48520e95fad2fc87c66a6e825.apk
Size

2.3MB
MD5

350bc3fb7a87bf6026c0e006e3f77445
SHA1

4cf89be4d3d93a7514582049d5632b3f1a6b8052
SHA256

7f86778b11adc997df2d943f889cceb90bf7e1f48520e95fad2fc87c66a6e825
SHA512

e2cd974755ee6e57d879f8a9fefef54aefafd4b7a2a8951ed1efced64ffc589ceb5304b82c67c935da85c7e7c6fc39779cda968cb410e18228e9580aa5e86ba2
SSDEEP

49152:iNw68Uy9Owo/SKq+PdHe3nyqjVJd7l763Tnvf8YCLYBlOHwhhOMiXdg/y:cfSOwoKKq+PdHe3nrbx56zfVCEBlOXb

Score

10^/10

hook banker evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

hook

http://91.222.236.50:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.buzaheciworexi.xacemi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.buzaheciworexi.xacemi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.buzaheciworexi.xacemi

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.buzaheciworexi.xacemi

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4251	com.buzaheciworexi.xacemi

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.buzaheciworexi.xacemi

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.buzaheciworexi.xacemi

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.buzaheciworexi.xacemi

com.buzaheciworexi.xacemi
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4251

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
3e00f6dbcb0cfad66c622c520c7ed190

SHA1
f3842c6f5b5d2e9e9d90a8c8458dd89c8c48cd2f

SHA256
9732e676c320f2633353edce75bdd87ba3d631362d8a81033eb77fc984e6a78b

SHA512
945128010aa9e67813d124da2f32914819c21fc7e60b6701472cc3a58e73236210449af8478660d84bbec29275adf3f8af6e10a9e597ffc6b4aa5a37665af7fb

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
8ea16a9bb7795a151c30292e6fbc8f85

SHA1
da05a3c6e0f5e51cdb2aeb48c7044f5fb15e334e

SHA256
db65e85aa7f9b6aed0eaaeef17cbe844e8c338fb4c132086dbcdca8ad731b2e5

SHA512
a72915b9cfde56ebc9d49e81ea919e47bf6ffefc9422c1744086e4985fac12d644a341845c2884c8b409fedf73eb5036a2ea9832a493f51505def818d79f1330

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
25f617dadf413e2265b9f5e0b3fde714

SHA1
ad51ae6a784f55d613068c20f599eebc0aa57816

SHA256
05328394f1123a32516520f7776fa40a4e6e960638a740bf4d469b5e8b597cc6

SHA512
3f93a5b50d6440be9e4c26facf2b443adaf6fc0ab083047452cc6ab66ae81e9d875430176c2d03ec60ebb64ca0f7779b6056ba3ab3503d78460933fd89d37a53

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b42bb30f44fdf85cee75eafd9ad66816

SHA1
26de768509ca7f9c9bf6928c41d3e0d9bd2f8072

SHA256
43af73a17308abf61e6ac45626cb5cab65b25d81ff47ba30ac44173641ec7e8a

SHA512
61bd820a573a78ba006f8b5201ab14415775aa32d247a9a24a0fa3c7ee8f0ba5ec5bbcf6b47c3925377bbef418b1734bbe425bf5d08781119bdc43ac54b6ff02

Download Submit