hook | f9db7aecc5c0a5102fca21c0166cf2b4d00150ff1adb8fbf609c09461dcf8c04

Analysis

max time kernel
150s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
05-03-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9db7aecc5c0a5102fca21c0166cf2b4d00150ff1adb8fbf609c09461dcf8c04.apk
Size

2.8MB
MD5

176c428b54970b3bbfb6931ead77003c
SHA1

6b056ff3c8dc76a62a96231abdf95f8f04b7ba2a
SHA256

f9db7aecc5c0a5102fca21c0166cf2b4d00150ff1adb8fbf609c09461dcf8c04
SHA512

e7ad56235fedfcf92a79cae4755afd9ea158249cb218098bfb3dce82824d37acf34506510fd011babff6266097ebdee4b21fc7f6c8c9a72ebdaed4ae72d2af72
SSDEEP

49152:zYHNjVlWPHYX8248jyBNDlYS9qBVSoAhtSsuhaEdn5PowLbo2msM30knQsPCJ2DW:gtVCu8248j2NDlhqBVSocuhaEdn5PowV

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cixacepufafikabu.golegupa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cixacepufafikabu.golegupa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cixacepufafikabu.golegupa

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.cixacepufafikabu.golegupa

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cixacepufafikabu.golegupa

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cixacepufafikabu.golegupa

com.cixacepufafikabu.golegupa
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4236

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cixacepufafikabu.golegupa/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cixacepufafikabu.golegupa/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e4c5c212326299eb312423883b2a56f2

SHA1
ae55de1866ffd3f6cfb2b66abc6d55f39919e310

SHA256
9849e8170f70fc89a6dc2c15bcf0c92be9cfef9b9e61964816312bf25e52f3cc

SHA512
ab29ed006d59a620728c9e270e73c471c5391482f2c53788eed8565e3c287a12d2f56a6a925691ae16aff2a042fe99e959bf75fe85fb48220346d8feb1a5bf86

Download Submit
/data/data/com.cixacepufafikabu.golegupa/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.cixacepufafikabu.golegupa/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
4fecb952437b610a18a12a80e6e18764

SHA1
f57272925ef3b4d7f11532e53b2b723b7a391e56

SHA256
371a883f0c5e9d7e9db95cc1af76113df82ca4ff42e4d6b0383e433547cad6f9

SHA512
9386dde78684be101b420a3d88f23e4616ab564cd4e8d556484f377c90d2e2bd8602cea48596dba2713a9a5c992d41d5f56615812c056d696e406afdcb58fbd4

Download Submit
/data/data/com.cixacepufafikabu.golegupa/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0bacfaf2cb9d48ecb46de9baaa178d0e

SHA1
2a81dd110f4f1fad0ef243e751fcd84c30dbee9f

SHA256
f68e461b50170e833aa7f257ff4d9b1ac12326a3156c998de4edc4356ff85c14

SHA512
c800170baf909b9fcc446f7b2361606a14cecbd1e3f85b157a2fb5e175e49e7116651eb56896ba9feaffbb3fa0c018b207e88c574ebecf745cba8adffe1e2440

Download Submit
/data/data/com.cixacepufafikabu.golegupa/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ec1c14c796ef682c721fcc22f7c8636d

SHA1
43e4ad8a014b0d0176238481e1e310ef20cf660b

SHA256
cc4b2068ed46e125db121ace266d8511d48b0e74a926c68b5065ff8faf7cb257

SHA512
ec269ad79f8fb0b244787a93c5b1e241b3bd659f1a5efc4c82feea167d2453baface699556063b89b2b2d7e93abfe3ca4c3cd48f5cd5e3fd4d3fb5a91f5241f9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads