hook | 7f86778b11adc997df2d943f889cceb90bf7e1f48520e95fad2fc87c66a6e825

Analysis

max time kernel
1759195s
max time network
164s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
25-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f86778b11adc997df2d943f889cceb90bf7e1f48520e95fad2fc87c66a6e825.apk
Size

2.3MB
MD5

350bc3fb7a87bf6026c0e006e3f77445
SHA1

4cf89be4d3d93a7514582049d5632b3f1a6b8052
SHA256

7f86778b11adc997df2d943f889cceb90bf7e1f48520e95fad2fc87c66a6e825
SHA512

e2cd974755ee6e57d879f8a9fefef54aefafd4b7a2a8951ed1efced64ffc589ceb5304b82c67c935da85c7e7c6fc39779cda968cb410e18228e9580aa5e86ba2
SSDEEP

49152:iNw68Uy9Owo/SKq+PdHe3nyqjVJd7l763Tnvf8YCLYBlOHwhhOMiXdg/y:cfSOwoKKq+PdHe3nrbx56zfVCEBlOXb

Score

10^/10

hook evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.buzaheciworexi.xacemi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.buzaheciworexi.xacemi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.buzaheciworexi.xacemi

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.buzaheciworexi.xacemi

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.buzaheciworexi.xacemi

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.buzaheciworexi.xacemi

com.buzaheciworexi.xacemi
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5073

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
649cd1968242be874fe792a05f673a92

SHA1
76a07d10c2dd3f230c76bfa0d0f7f1ec4d9669c6

SHA256
dc900d5a66ec9b628d492e780c886f5458d0ef8b22eff98bd2957652ce7dd6ad

SHA512
7872226755fda603b6f8451708370b9bc4c5bad344a19138569fcbeeeaea48f053d5485ec9bb260eac105c8fc51162f7e30ead33d1484697eabb7b21d6056409

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
eceaf233cac66bc90cffb3bf8e47a925

SHA1
918f3a76aa4896b0b4234c6aca6394eb956384ac

SHA256
9df9770a705d3ec358c762378a2eb2d03fc042fcad729b874e2bfd884d2e0b7a

SHA512
7af527f56ef514e91a14aafa0aeb85c2cf1e4e935bbe371f54ab278034cfacd7fe4039fc2a6513e6d6e90525d26de0610eb43af3abf400bf430f66e831cd8fea

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
018de5e1009f2188e420fc812cf49d1d

SHA1
b6ecbc8c7106763afc0ea8c2e10af3c25585c357

SHA256
0edd03c0b27d63715bb61cc13aa528d287f6a28fea4dd7c045dc8e039d3efcf4

SHA512
56f67df02104141c94d8a7dcba3166f1d3a6dd5caf6af5c93124270edc260272311a155a338dd4d60c586fe933aea638305f2b408366628a64284f127dcc2d95

Download Submit
/data/data/com.buzaheciworexi.xacemi/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
4513853572f82a13ec75b570a35c3779

SHA1
4b545a8dc33118b9e59bfc148ad17d0bb1fcb080

SHA256
af398c38391033dcfdfa80a3548abf123a7e51beab4ed0a2b7f26b8f3502ec70

SHA512
dadb667160fde85dab0fa100441f24e345fc9af8ef5d30c244552567c534d12cf8c690dcfe502689ee45d205690bca600f11c1ec0aebc7e937b819835d04a548

Download Submit