hook | 6457c9837f35011200dbee5a82e7f73a09f53b2c68296dea01838e7714d9e1ba

Analysis

max time kernel
402298s
max time network
158s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
28-11-2023 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6457c9837f35011200dbee5a82e7f73a09f53b2c68296dea01838e7714d9e1ba.apk
Size

2.9MB
MD5

f68658df74ae791d3cbecd205722cc41
SHA1

ad879f0d74d16d7d5d4ec44bfbb8fa931c55a4f0
SHA256

6457c9837f35011200dbee5a82e7f73a09f53b2c68296dea01838e7714d9e1ba
SHA512

739fc004505dc896d83102fdf2a8b09181e333e37e61919ee4981ff35d983187e0932203e15b23df80ae5da95c539891bbcb43c45fd2240ffb732ba2fbf509fb
SSDEEP

49152:C+JUfMl+7ZDPazbnhpn1zvMSjjajdyVSWrqc/b4oc2E8j8vEAinD02zmNSIaX:C+W0lIezFp9tkEbZ/j8i028e

Score

10^/10

hook evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://91.215.85.22:3434

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dekezumepome.deyecite
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dekezumepome.deyecite
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dekezumepome.deyecite

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dekezumepome.deyecite

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json	4303	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/oat/x86/aMd.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json	4277	com.dekezumepome.deyecite

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.dekezumepome.deyecite

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.dekezumepome.deyecite

com.dekezumepome.deyecite
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4277
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/oat/x86/aMd.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4303

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json

Filesize
705KB

MD5
90fcdd911130185f883976c36faf999d

SHA1
d86b61ce13d8f8c67d14168191a01b617c1855fd

SHA256
31c47cdcf1e5ad1c5eb62a19329bee13518182e07c75108d819cb25644d32cda

SHA512
760fef18b8a85b76bd50d93821e3eabf972fdb1134fa7e148272e974b92ae4647624a7f702309352e112be98c09d1cc87a48498fef9aaa27849fc931ff33fdcf

Download Submit
/data/data/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json

Filesize
705KB

MD5
a37b0504afaee8a8fa7aa37dd0a8b528

SHA1
8ee3d308fdbf279011a5906955a16f8ec9348500

SHA256
3e143edb0b456f29437842c249f5602d28e07250049ed0d7e030ada41bd6c269

SHA512
6399c27a949cd90cc97940b0875ddc261ad4168f8d0d6117c23bdbd7618d75033e47a88b4318fb0487dd635682546754f22b795b101df01b9bdbe178a8ac00aa

Download Submit
/data/data/com.dekezumepome.deyecite/app_DynamicOptDex/oat/aMd.json.cur.prof

Filesize
2KB

MD5
a448c224c99c5d6bfacba191fd43bb73

SHA1
fc1905fa611b61173a1f781815a854b467800b72

SHA256
10ad0250119b212488c4a0272b491830e09f659d40150a727f11e5ec4572fec8

SHA512
f1933f198081552df373350173a64a5fc28bd9ac1941300b2a7d07abfedc2f76170aed9caee10b96efda3c2d5f9d59d172d65738fd599608f67b7f912022e8d7

Download Submit
/data/data/com.dekezumepome.deyecite/app_DynamicOptDex/oat/aMd.json.cur.prof

Filesize
2KB

MD5
a738b1d3fc49f44a7284f7cf0fec9f93

SHA1
1b6f9fdc0853eebd1d9200c37cd16f87fe846828

SHA256
84fee273f083f410b592f0f29855355016db52e514a61f979cd4c042998cffb9

SHA512
a4783baa407d1a19e7e5690da0b3fd325154f210aba0c8ba4a748a2b155ea776cf253e5f033b8f5107d972a72a0b0639c62b7eb531725503357d07110208dff0

Download Submit
/data/data/com.dekezumepome.deyecite/app_DynamicOptDex/oat/aMd.json.cur.prof

Filesize
2KB

MD5
ec733a07ac63c33199a78c8e6428e7d0

SHA1
20152dc83612aa57e291393bd7f39ee2239196e9

SHA256
4cd015a1352f894d8b8fe11fd36aee6b4e54dd8cfca50e6c0f0f7a7c8c3c2fc7

SHA512
f02b73f03e70ac40156197c7e4c9caca5dc2c6d8f029985e156d98a31e52306b8274aa7aa51038bba7064766b17b087389f394076dba7622905deee17af47b17

Download Submit
/data/data/com.dekezumepome.deyecite/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
aaf138e687d5d4e42b3da031c08dc462

SHA1
5384531b5d3d3964df3eaf5e0360218e5af33738

SHA256
cbee884d4e00bc7451a7bcf577ff316e208b7406c9dbdd0ada491029e2703783

SHA512
1f77c02c9518d3abfe1dfb8e4028ae4bc747393f252e1c29e5b0645eefd883dc2caf515658e19122e667b80ee6658fbec237f887dfb608f0b2d68dbee0b51411

Download Submit
/data/data/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
de1d95ab90ba32ee26e20ab5a4cd2742

SHA1
a3a301e9bce19532270927fa4bda077bf6798327

SHA256
a2bf9cd67a35675ca74c144b5d78f99ad45135b0f28e73df647e2abcb17a3de2

SHA512
5b266f6603bcb31b8c8fa501a55eb1c5c2e850ae231ecb0a727f4d603b8e7da5a62adfb9592e9718de09f539de71068e888c1ea622d2f538c6cffcd1908fc8d3

Download Submit
/data/data/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b6e79064002f1ff4cb911c7a8c720522

SHA1
8cb128fba35bc49dd4bf684fa9408c8c407ed991

SHA256
ffe248dcf93868e1bd5f9c652269637eb6e3d963e317e5a45deb223f43889c8a

SHA512
4b12df3fa1e951969c70cccbd060b1b7210e06362902f7c640ab26721e8be8025acfb8e4d607a7c1d00d8df09d3ac1efc9b2fba4429245ec690bef678653b9c0

Download Submit
/data/data/com.dekezumepome.deyecite/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
05556b90a561d6df9fe8f12f2535a992

SHA1
1cbced4fbd5083f5f3100205c77f8910f064f767

SHA256
eef4b7603ebbee0ae8b9a4036c307d264e814203ff2544f3b6669f2d226dcac1

SHA512
c2d5107e44dc59a34b3cc217529a58058dcb1fdeeb196e53a90ab57ef315856efaaebd0acd8beddf4ba2e8fc9d01f24234f457bde47ad41c2d90963d7f7ea836

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json

Filesize
1.5MB

MD5
552e831024735ff8028c2932b0ee0856

SHA1
4a6a1b4fb92992f06f4a45962600f792a50dacf3

SHA256
5475fea7235e4ce023db46a8cb67b57052950e8156b9dd361f384c9cab17d395

SHA512
04f2f307f4c6305d326f68dd2f8ff57d7d844f535607983435c0bce55d589842abb87a1c88211ff8c8e50be7f5ee33a4677ab5faa569d4102d037f59a661cfa8

Download Submit
/data/user/0/com.dekezumepome.deyecite/app_DynamicOptDex/aMd.json

Filesize
1.5MB

MD5
75b6eb041c5124ca9fbf00d0844263d1

SHA1
c3dde78a6c27f78c8a4207b190bd7ded6b1a6887

SHA256
444fb400283211eb44017d60a707e63d140a6101fb58f5b6a7662559f9289a9c

SHA512
fef37cf4b613e976fef071bba2ddf26ac1c72110861c49589f7e05cd18f050ada78ef7515477cfe56ed162ca9e087ac4dfa277cd1b1d517fcdc2958eef22dda8

Download Submit