hook | 362d9b6948b901b263738736f0482706df81ec0c3eb354d79d75a1cb20c0b77f

Analysis

max time kernel
3283671s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20231023-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
submitted
12-11-2023 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af19050f00acd13574451cc16e587cac.apk
Size

1.1MB
MD5

af19050f00acd13574451cc16e587cac
SHA1

f3540be84bbdda033c564f30c8fb8cd7a25578b5
SHA256

362d9b6948b901b263738736f0482706df81ec0c3eb354d79d75a1cb20c0b77f
SHA512

e1a48f014ab9636ba77e56742b1a1c884b9272b34a2af0d37cee11aa63ab75f098effa01607f3264a7cf43e255b670f21da939c19c3c65f9ca8ad307aff57eb1
SSDEEP

24576:18HQh8D2S7ML127PRohZWgdJW+AGuTp/ojDgpg/nKKf:18HM18PChEgdJRAP/2gpg/Pf

Score

10^/10

hook evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.buxamudekehuro.zoxu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.buxamudekehuro.zoxu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.buxamudekehuro.zoxu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.buxamudekehuro.zoxu

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.buxamudekehuro.zoxu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.buxamudekehuro.zoxu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.buxamudekehuro.zoxu

com.buxamudekehuro.zoxu
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests enabling of the accessibility settings.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4525

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cf622ff87b26af78c072ee06211c5a0c

SHA1
fac1745260000fc550233421db07cf4067351d24

SHA256
3d407643795a5ca01c8db0e371d6a7abb884ea6a9214e86ceb6426d52bcef915

SHA512
ad37bc9b94750bc5bca9dd4dcdaadebec148d52667ed10bc8cbf4f886d104b5a6ce41a75ae6f3d904b89d871c9393e26c9f1184d13702298c1825d23c802aebe

Download Submit
/data/user/0/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1198b576dcb69742e6bc7a725f52ff65

SHA1
698d2be28455bd46e0ed35feb0d2f8fc2364aac1

SHA256
7dba689941a012ed43a853ef4ca16f74d931402f6e2f0a9a865271a4539f488e

SHA512
c88c5a4d5f2c15ff9f10e8f31d34441f6fcc79fbdbd6f1d5349f3e15a95d4c5a529d6aabd090a288159e544663535e64be8415053162089a24fcc1942b0fcd69

Download Submit
/data/user/0/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
a2e2e77b2a12a5949a1a3bda57e7172a

SHA1
40d2d7e704365cc4a74ebf19c7187e9b14c88126

SHA256
b23539a4fc7b400ad8d690b4cfcac1c91cafb0c5d36f0d21bc4d098c44300377

SHA512
fa4dfb566e86379818cbf27b6ca6a60538c7e34a3bd78948bf843e733be89b3abd51a8a1171cc16e6fe82d8d3c148eb9769c901f03b6fffb40d0f93cf018b062

Download Submit
/data/user/0/com.buxamudekehuro.zoxu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
a58015ce8f98c75e7c9cefdc11f456d5

SHA1
bb6ad55e4676eb0f5190199687ea8bb7fa08fa8c

SHA256
bc89525cbb4b5c4aa1d520a6f71fe6c07c1f5ddec6fcc84f569a1b3c54a957e2

SHA512
45dff95d97e63d5fdc66cd1b58884f8fc1c6b4cb4c0d880023af343685e842e04175c66368dfcd092791818c7e6d6f508afc8cc540e8069c2b2160b2effc06f1

Download Submit