hook | 10931de207177fa1a1ca4cd2bc2f289789cd28cbe4b95ba92583e3b451e19086

Analysis

max time kernel
1871671s
max time network
156s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
15-12-2023 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b264466e215505230540b4ac4d01ef47227a80acd33be86835367cbf362dbfe.apk
Size

1.1MB
MD5

297c76363e44ace3376eaab9fd2b620f
SHA1

ec099e01d689e5cf03dbf84b4cd990aed6d80441
SHA256

7b264466e215505230540b4ac4d01ef47227a80acd33be86835367cbf362dbfe
SHA512

7d1fe4344f20adfd7cbc801557894b37b7dcbbb0089aa4b00e90ade477d83275539516a5b53e4739e4fde4cfb22a3db2eed689410aa21895bd351f58c28506ef
SSDEEP

24576:ftd6Z1nU34NqBVxmcU/O0p+cwNoIReAxI1U/ojySUg/fL66:1d6Z1nU34ND3+cwN1ReNa/XSUg/26

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.jipegepoxazotodi.rediruvo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.jipegepoxazotodi.rediruvo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.jipegepoxazotodi.rediruvo

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.jipegepoxazotodi.rediruvo

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jipegepoxazotodi.rediruvo

com.jipegepoxazotodi.rediruvo
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.jipegepoxazotodi.rediruvo/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.jipegepoxazotodi.rediruvo/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
df5813951171bb71b0d0d30a61cc9e0e

SHA1
4f7357ac80cfbe80065ae1737e462fcf2c8a834e

SHA256
9daa8a8ab8c8a00ea9b9ca29b3acd8eafa0e8901d35a9dae65ca9d086ffaca09

SHA512
74ccd4879836d32231161a5460b894b8646907ce768bd3592a26cacd8cba04bb3b4a37773b60862663718a47cb75fc8daffa3924339aac1487d2e94a959936be

Download Submit
/data/data/com.jipegepoxazotodi.rediruvo/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1d894f98915a5e07da0b2ccbb679ddd9

SHA1
ceb218cd4123218d16d25ad30d1fef13303b6b93

SHA256
20db90f696bb1becaf19d92e1b4f1d53145532cdd9d686e972fa4965db485426

SHA512
0a3c0b0bd05e1c99bb19fbac5edfc10e6095f418cfbc019a52219d5e869a13aaf98dd1e1d188b380c8690f74ae9959a16b1be5da3216a87541f5ff8031dee7a7

Download Submit
/data/data/com.jipegepoxazotodi.rediruvo/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
da01a626b347294c5234f990c22f7ed4

SHA1
14fc7c036738b5b3a0bff9051632c9721b48c377

SHA256
bef2b9ed2af1f39c249797edfecbe53112305e796304b33c161414359968cac5

SHA512
6fccb432bf0c7969fa415dca45fa0bdb40a721e982a3f19c0d38a873d70a865fab50f0a0b760426ac3bc8689faa85c9de921164b6b7d7c937e9253fed09a4b6f

Download Submit
/data/data/com.jipegepoxazotodi.rediruvo/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d1a3422c24c85348dc2c4f6fad6decb0

SHA1
0ed7830b9c723f418021c12cc99edcb6d7bf47d2

SHA256
45560e8c550ec9170c97fc9edb9a726a265b87739dabbf3a67b24e904bed278b

SHA512
bde681871c0e0046a4f6d5cd08e2c01088eca7431547f1da63ccd11669881d9e185ae16bcbb6d3889ca957a714ede369e4185b02b8eea80f03b69285d59f1b95

Download Submit