hook | 362d9b6948b901b263738736f0482706df81ec0c3eb354d79d75a1cb20c0b77f

Analysis

max time kernel
3283708s
max time network
166s
platform
android_x64
resource
android-x64-20231023.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20231023.1-enlocale:en-usos:android-10-x64system
submitted
12-11-2023 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af19050f00acd13574451cc16e587cac.apk
Size

1.1MB
MD5

af19050f00acd13574451cc16e587cac
SHA1

f3540be84bbdda033c564f30c8fb8cd7a25578b5
SHA256

362d9b6948b901b263738736f0482706df81ec0c3eb354d79d75a1cb20c0b77f
SHA512

e1a48f014ab9636ba77e56742b1a1c884b9272b34a2af0d37cee11aa63ab75f098effa01607f3264a7cf43e255b670f21da939c19c3c65f9ca8ad307aff57eb1
SSDEEP

24576:18HQh8D2S7ML127PRohZWgdJW+AGuTp/ojDgpg/nKKf:18HM18PChEgdJRAP/2gpg/Pf

Score

10^/10

hook evasion infostealer ransomware rat stealth trojan

Malware Config

Extracted

Family

hook

http://192.168.163.136:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.buxamudekehuro.zoxu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.buxamudekehuro.zoxu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.buxamudekehuro.zoxu

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5066	com.buxamudekehuro.zoxu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.buxamudekehuro.zoxu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.buxamudekehuro.zoxu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.buxamudekehuro.zoxu

com.buxamudekehuro.zoxu
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5066

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e9a633ce4cafbe03fac9b0756b4de0c4

SHA1
bac4b7727e318800bfaf985c7b6ddd986b5a4351

SHA256
94be9424b6924b51636150dcf3be7ef60eb91ce6d1bae598b98ebdacdb2b0290

SHA512
132296f300ce7eff13005c94bb37c6c9715922f88ae63056b682873ee86010885a3f33f543809d80aeab3420abe78cd3609141490ac55868ef9e1ee72fbe861b

Download Submit
/data/data/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
63076828bee72360ed812c64b1ffa574

SHA1
0ab854beed3b25856c8abd6d932f8e84a54f2484

SHA256
0617bb752c1b104238d81692fee8500278fb4a78889d1caeb4fdd27e0a6871fa

SHA512
ed3982ac304801f8bd31b1f8fb608854107242c2dabeb27460a1a8aab07fdb994fdde093ff8827395c3ca4c8cc2dde2add81cd0832ef45d7614f474c78b3dc09

Download Submit
/data/data/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
5b29f32da206cfb6b0d14c1d6110af44

SHA1
91f353d6dc5ff00f3bad255bfe59c67c65868e9b

SHA256
670873aaad7626f31e436d163a36b1beb622732e8a569b24e6f3e0ed9564e6ec

SHA512
58cfbb56e160d54a9b68b4644ff6a76344aa1ed42ea82f0d5b1bfcfd111e9ecb542e77c5bed03279a0d9afb3072aa8d56b982090c8224aad64c67fa010ffe09a

Download Submit
/data/data/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
3bf881c32976651c6b7a0fcb5e841ea9

SHA1
c2819ecfadd7c4eb6aa9cc142e5ff47f36b330b1

SHA256
2eaf1594d9eba42c7f3f0b9010c46bd7766f9d5c01f3e1d8c4c8d93f30ab0ad2

SHA512
4b03687f3534ded662c52ac96d16a59e955815b71ed93438c8847b2bb877a115664d2dc08136f99c11b8caa32fe505bd29ddab43877bb72620f397cf01114b4f

Download Submit