hook | 98ec0c587100d35500cf64dbea79054417477522438e55ab2949ce079d6278c9

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20-01-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98ec0c587100d35500cf64dbea79054417477522438e55ab2949ce079d6278c9.apk
Size

1.1MB
MD5

d2ceaa255c3c2684d843e3d8e25de89d
SHA1

f65a3cf7fe2c80d9727f72b7a32efe6dc9352066
SHA256

98ec0c587100d35500cf64dbea79054417477522438e55ab2949ce079d6278c9
SHA512

47aba42179b3a9eb161414783fd36ab96a649f2e19b44a0bdd1e34510233a4725f95c854715e5b0b2e3b19be17156f5952000d2d3f33be62a4671d913ba831ff
SSDEEP

24576:5/9BNPqJQT/JSuC+0SvxQnTgyZmeSuoj4Tkg/88H7:7qJQT/JSulZSkWlTkg/t7

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://172.16.39.137:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yumafudibavufu.nuxu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.yumafudibavufu.nuxu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yumafudibavufu.nuxu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yumafudibavufu.nuxu

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yumafudibavufu.nuxu

com.yumafudibavufu.nuxu
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4249

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yumafudibavufu.nuxu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yumafudibavufu.nuxu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
efa10c372528332abe36ed4d7688664a

SHA1
eb622b6cf0644e3634329fc075c9d707e61b6119

SHA256
1b3dd7ee7d8365cc9cd57dcf8db344ae45b276bf03781e44e7ae1594756686bb

SHA512
a3be240265b17a4a84b4e875fa66dcbf444041d678e741c3efe766bc81a1b52310c028d8b640f879f9c44f7ef44dc55a0ea66cb5898e40fe58712069b48bc4b4

Download Submit
/data/data/com.yumafudibavufu.nuxu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
e78c53a21133f7b7cfd70ee0d100e04d

SHA1
61f0de90118b9213c88a8893e66e5ff73f89ee24

SHA256
2a5aebf9c74c6841e946f87c3e644fcb6534ff85912ea856fc8d8ed17c577261

SHA512
3df78d1d83d38ae6960772dfdd830a4b9b9f75366a0e81039a27951588bc12bc16f29a79c2eaf295f507a759f1ada3ca10aa958fe630a24eafcccf490a0762ef

Download Submit
/data/data/com.yumafudibavufu.nuxu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
3d2b06764926cd3448cf9d825cb75a7a

SHA1
9465e19bf1d6e26ec2b7d35af280788e66631052

SHA256
d9b44d47996325828f2fbdccc584bd02ebe9e9b9da2471753b5fb35837f2e0e6

SHA512
fa408d5267f80d59a1e290da5a8dfffbb69932a964c6282a84cad64d34830d964a81c2416c76adee8413c978490aa7c19ac5a5816a7d0200ac68f1f1b9157c22

Download Submit