Overview

overview

10

Static

static

6

fa573404d4...8f.apk

android-9-x86

10

fa573404d4...8f.apk

android-10-x64

10

fa573404d4...8f.apk

android-11-x64

10

Analysis

  • max time kernel
    17s
  • max time network
    158s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    08-02-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f.apk

  • Size

    3.8MB

  • MD5

    a8257430863a22831e1d8cdb11631c72

  • SHA1

    0f28ef7b07d8d1e92a9f2b310bf060642a57372b

  • SHA256

    fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f

  • SHA512

    c54c85eda2c08a7a8c07d43e8bccb7a372050937639c78e06cd3518ec9673e22a29f74ba0d25c5d49005ec380ddc82e7aad7db34a6e991e56df75c78369b17d3

  • SSDEEP

    98304:fwRW6/qw8ebq4uKM7uyOBOjzxkRThoHWDxu8WD8X:4l5bq+RUSo8W8

Score
10/10
hookevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://aubhdva.xyz ; http://aubhtri.xyz ; http://aunuredvac.xyz

http://aubhdva.xyz
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator.
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tyfnblmvz.gcttkdnri
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4260
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/oat/x86/xypkouu.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf
    Filesize

    26KB

    MD5

    18caf9ebe1814bcd8c6e4e937cee3a52

    SHA1

    f652938ca3d0a0a403035d0acd2214f993d0ed7c

    SHA256

    cb55be854c57a5171ce9aa1dfa5cb84ff6e30c7ab95348e9f9061af99244a23b

    SHA512

    3f2ad66da8d516cc4b3615a8a6b5ea878d2c32aa30f99ce4585924b68121eca95362e44361b01b3eefa075f117adcf5b1826edfc493f9aee006f86fa10bd1531

    Download Submit

  • /data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    4fcb20f64bfc4dd875cd1c3490f4bea2

    SHA1

    44f5f9051f299d44796f3045e168ab6a63a3b2cd

    SHA256

    2dda85aeedbd69499543727d34ee45ab69ef7e0c8e42e79cf6bb7c19db39e9ac

    SHA512

    ea8b3a68afd3c3057601f9a44202cd0106b576f872fd10bd550feb6b96403abbe28815ae1e7dadbb4f1b544078e9ae8afd4b0cb751fe3bd1ae37a7059534e1bb

    Download Submit

  • /data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal
    Filesize

    148KB

    MD5

    f45d847a7c108045d28f51b2eb1a58bf

    SHA1

    68a691127fb591080522136c5ad7c860d3fda46a

    SHA256

    0156bb0b32bba31a38020dd90ae0ef6a86b7dfcbd666c098c5741ce83baba2c6

    SHA512

    39921c46d2542cb0bc24ffe525071987586296cc5c0cbe4da6ead4ac51a971c6e77ff0598ae99af45ae2a6112407df27182bffc166955a7c3852791b6629bf36

    Download Submit

  • /data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    ddcf3f953a06628185c19e60128a0095

    SHA1

    1dbc6c8c8ae4d477f8dff0d3af8815dae24a7f2f

    SHA256

    78a2e3dba03f71c7ccfd83cdc1d17437eeddcb1af2f67ff7bba3379076256d31

    SHA512

    03ab0bdfa5b5e3008dead0a6bc23b564d6f50be9fdb8973a80cc804ded474373457d11bd71071bf42d2b5e8dcc62cb05629272578a159616ea17ce71314d8568

    Download Submit

  • /data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf
    Filesize

    2.0MB

    MD5

    b7fe186741a11fa714433dee8af32024

    SHA1

    022e89aa4845eb5307894fc98d2924e3cf97160e

    SHA256

    101d6d52ccc675449f12e12cd9779970d2b82329a7b4ee615aeae415be99a18f

    SHA512

    f389194ab2964044380c08a20bcb54417a142dcfd2e857ff71dfad181c8cc924085d489857e1279a5a5586b1b21068b152f4f7aa58befdb0115a1c62da37b4cc

    Download Submit

  • /data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf
    Filesize

    2.0MB

    MD5

    de29a9015306b8933c2d91d4b7aca0c5

    SHA1

    1cae611b73965edf2f7a77e8b35dbc3266014396

    SHA256

    601b1ad3775fe23f19dab07aa975450aa84c29e849e79a5f77a90dc2bde7a32b

    SHA512

    3f41b0d30b737cd5b7a2f4e8ce732cf7cd549e50df7a02822bef469ff9176bfbc050285ecd9d0a75f77f04fd20f0cd9c7c3a07822d81aa513609e9379f86e483

    Download Submit