hook | fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f

Analysis

max time kernel
150s
max time network
159s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
08-02-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f.apk
Size

3.8MB
MD5

a8257430863a22831e1d8cdb11631c72
SHA1

0f28ef7b07d8d1e92a9f2b310bf060642a57372b
SHA256

fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f
SHA512

c54c85eda2c08a7a8c07d43e8bccb7a372050937639c78e06cd3518ec9673e22a29f74ba0d25c5d49005ec380ddc82e7aad7db34a6e991e56df75c78369b17d3
SSDEEP

98304:fwRW6/qw8ebq4uKM7uyOBOjzxkRThoHWDxu8WD8X:4l5bq+RUSo8W8

Score

10^/10

hook banker infostealer rat trojan

Malware Config

Extracted

Family

hook

http://aubhdva.xyz ; http://aubhtri.xyz ; http://aunuredvac.xyz

http://aubhdva.xyz

http://aubhtri.xyz

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tyfnblmvz.gcttkdnri
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tyfnblmvz.gcttkdnri
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tyfnblmvz.gcttkdnri

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.tyfnblmvz.gcttkdnri

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf	5065	com.tyfnblmvz.gcttkdnri
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf	5065	com.tyfnblmvz.gcttkdnri

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tyfnblmvz.gcttkdnri

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tyfnblmvz.gcttkdnri

com.tyfnblmvz.gcttkdnri
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5065

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf

Filesize
42KB

MD5
62e77a28f11f8f95cb3e49102bd16d40

SHA1
5da6b678708ce59bd8d343365f80a3b39450b4ad

SHA256
14a8ac59825b3b0a382b76843231ff8e8a3f0a357e7af6f9a5ef2cf0e7697426

SHA512
e9b2e5e03b51824dc11a77e0845e3d97b60093aa2243a5af49482c56201c918f415b41e7e94f301c15e765d0886ab1366e592d72a4f6d76fba051ad991413a7b

Download Submit
/data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
882972a4abb41a33e9000e106f6f3d43

SHA1
5ed6b02cb7966b8b1a01e3eca355d33cbb1723bd

SHA256
fac08d199f6a73362bc25500a6a8efb83754848442da959bb49e072c00fcd2dc

SHA512
19edbe4a6d954304396b2f2cd11e15a7d31b4ba874d1d98423f734044ecc158612dcb571cbe2be604e0ba408d53e21a54ae43279e4aa59b70653c6991ec0d616

Download Submit
/data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
489151b0538d2701b15549dcde3be9c5

SHA1
4e6fc73de4e59ab8a47a98e6c6cca6b14fdbae89

SHA256
06ea1a4e1a7a551a4f087acd8ffac1ee75cb3a7e4597bd931993c546eca2536e

SHA512
1c98f32dcaa5e3bcc930e6c873235b067ed9365b5db599bc20b3f262e65ed2f95f9a81d355a2079bf4d29a37a0f04cfd1a0737deda00b3b0b5688eb8f6bb4244

Download Submit
/data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
20dcfab7f896ee0d00c135a35392bc7e

SHA1
8205efc9964a9934bf227c6a76c89f886317c82e

SHA256
1de5d0de292ac0add26fedc6a1d0fa1e27d9684b339ef915bcc279973a85e813

SHA512
34484352b560a5d12dc36bb7b95b573f2157e7c7c4f8130af371fa61bee1502d34ac1542251f451fb121369b304335fb837bb23a8cd131fdea8542a0c0a44ae0

Download Submit
/data/data/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
c8757ff56559a18d532592a109a08185

SHA1
2ceb96f95d741b930f3313901877db55e795f555

SHA256
7ea672f6fa673cb339109d51ad1653716314eeb61a51d599f83e42e024c1f87b

SHA512
91f393de6c52143d7c242c16459401fbcf9774d4f280d7fe37f4cc6dd175d0d42bfbb48d9646e6e9d142166759daf785e086d6c678f19d6096eac37349a05a35

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf

Filesize
2.0MB

MD5
b7fe186741a11fa714433dee8af32024

SHA1
022e89aa4845eb5307894fc98d2924e3cf97160e

SHA256
101d6d52ccc675449f12e12cd9779970d2b82329a7b4ee615aeae415be99a18f

SHA512
f389194ab2964044380c08a20bcb54417a142dcfd2e857ff71dfad181c8cc924085d489857e1279a5a5586b1b21068b152f4f7aa58befdb0115a1c62da37b4cc

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf

Filesize
803KB

MD5
dfe36697d6548794accd8990b7cce33d

SHA1
1973776e907d6497cd2a599c9f459dc08bab95f7

SHA256
ccbba762977f3f1e65307bc03a08be68ac1f5cf8eb3132ad23795524450cb66d

SHA512
77db7f30a3bf93c358761917a46a3ad65a98866b8bc478862cbd7fa26912a75799b23d1910cc65b80cbb4f942349772262694f2e0157cb5276e79e6e3f61b6b5

Download Submit