hook | fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f

Analysis

max time kernel
152s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
08-02-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f.apk
Size

3.8MB
MD5

a8257430863a22831e1d8cdb11631c72
SHA1

0f28ef7b07d8d1e92a9f2b310bf060642a57372b
SHA256

fa573404d405f5ca3d2502e240cb5181aaf26dc0bf3db4ee4e01909c6c12428f
SHA512

c54c85eda2c08a7a8c07d43e8bccb7a372050937639c78e06cd3518ec9673e22a29f74ba0d25c5d49005ec380ddc82e7aad7db34a6e991e56df75c78369b17d3
SSDEEP

98304:fwRW6/qw8ebq4uKM7uyOBOjzxkRThoHWDxu8WD8X:4l5bq+RUSo8W8

Score

10^/10

hook banker infostealer rat trojan

Malware Config

Extracted

Family

hook

http://aubhdva.xyz ; http://aubhtri.xyz ; http://aunuredvac.xyz

http://aubhdva.xyz

http://aubhtri.xyz

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tyfnblmvz.gcttkdnri
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tyfnblmvz.gcttkdnri
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tyfnblmvz.gcttkdnri

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.tyfnblmvz.gcttkdnri

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf	4479	com.tyfnblmvz.gcttkdnri
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf	4479	com.tyfnblmvz.gcttkdnri

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tyfnblmvz.gcttkdnri

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tyfnblmvz.gcttkdnri

com.tyfnblmvz.gcttkdnri
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4479

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf

Filesize
8KB

MD5
55a0bba157607a88249595bcdad65b5a

SHA1
1cce89d68660edea1b20d513ea62c6680152f48e

SHA256
1186bdb1de5e97a51b168109882b698c4c3d9ac2b34a3484e202f9227d877252

SHA512
a13885d29b386c59388fa0acb1fddc6fd33d198c969514909219bac42af374e8c7f769113830b1aa1922aa85f244ec0e7f33e89a56dc9c474886e8b5f8e21b7b

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/app_app_dex/xypkouu.onf

Filesize
2.0MB

MD5
b7fe186741a11fa714433dee8af32024

SHA1
022e89aa4845eb5307894fc98d2924e3cf97160e

SHA256
101d6d52ccc675449f12e12cd9779970d2b82329a7b4ee615aeae415be99a18f

SHA512
f389194ab2964044380c08a20bcb54417a142dcfd2e857ff71dfad181c8cc924085d489857e1279a5a5586b1b21068b152f4f7aa58befdb0115a1c62da37b4cc

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
53c7124516fbea6ddfdaf60594257833

SHA1
16b75dcd93f7e0268dff0801e569061be14a05c9

SHA256
8b6dcecaf385f97a7fc1b4b4a5879788972d984265f8120eebb0e8831a103f90

SHA512
e93442ee456443d7e06f9a22918a841651acf85ded817d0d330eb2f0f8006f8464bb92765f6a5e134d1f29d6946281ebf9902379b57c1861add08e797aaeb7d1

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
e8a28bfa4059086402897ac9f3fdf927

SHA1
1e8395c4e4036533556033dc6dd2c336a6df96e6

SHA256
9671c7059c1032873a1f3cc8a339b5186ff3f148e9dc5976e68068b433f847cd

SHA512
31ef7e07b5f7b3b5f76b30ebec1812b51e436f3ebe5deeb30c9902d168d0334617ce80813e2cf55575386c2ef507c3129e78a13d94c08a995cbf84180fb8dd98

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
69e2f3c5afc5d516d0d9fd1e0d07e75f

SHA1
113714f69b320f5394319c55e448522ff5369b92

SHA256
c86deea1d2a734404a060745c18bc9c058e88196b9b90b95464eaabc50e53392

SHA512
b4ce2cdce995db7b06534846dd2946fc9c231ec1e05be454a042c4cbbbaf365040aff11a7053a5184e4adb8a8ff0dfdf175afa8985f5c98add7d070940e0b0ad

Download Submit
/data/user/0/com.tyfnblmvz.gcttkdnri/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
ce62520733bb80588af0378cbe1c6631

SHA1
b2a90c51781b94e9ab25583b2013671d28c99096

SHA256
33157c6ebedfd24a958afd16df4fd518b814d267107523449ea12b15114bde83

SHA512
c74430bf61be7b8fce0cb9de123f22c395587d70654d24913e6f827aaf6ab5384e7c128e2b1aac23a7b3cde4ad6de45d87dba6b910080762696c1d9cce20ae24

Download Submit