hook | b5f385a83aa4e72290764f9474f185c7f8df743407161af1b1451f8e04faaf4c

Analysis

max time kernel
147s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
01-05-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5f385a83aa4e72290764f9474f185c7f8df743407161af1b1451f8e04faaf4c.apk
Size

1.2MB
MD5

206a7459aaf51cd8d5a4fcb77d74f813
SHA1

3bef6e09411fe161314cd14205b55b857ceaa6a3
SHA256

b5f385a83aa4e72290764f9474f185c7f8df743407161af1b1451f8e04faaf4c
SHA512

d8be96bb6af45ea3f31bcfd0a39d4aee036cfb592b95004a449d1c443d212e3b3d825844728afc9618252c6e5cff7c4fe0f9825c23684a92ce246ce13a30394c
SSDEEP

24576:9sMy4mXQT/hAiEew+ILc+FsaoD9ZnANn0FksNHRK07g8BLkg:yi/Stew+W9obANn0Fks9Rj7g81kg

Score

10^/10

hook collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://91.92.247.254:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.IuUArrYHQmiA.gXuDiMTQTyIt
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.IuUArrYHQmiA.gXuDiMTQTyIt
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.IuUArrYHQmiA.gXuDiMTQTyIt

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.IuUArrYHQmiA.gXuDiMTQTyIt

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.IuUArrYHQmiA.gXuDiMTQTyIt

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.IuUArrYHQmiA.gXuDiMTQTyIt

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.IuUArrYHQmiA.gXuDiMTQTyIt

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.IuUArrYHQmiA.gXuDiMTQTyIt

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.IuUArrYHQmiA.gXuDiMTQTyIt

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.IuUArrYHQmiA.gXuDiMTQTyIt

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.IuUArrYHQmiA.gXuDiMTQTyIt

com.IuUArrYHQmiA.gXuDiMTQTyIt
1⤵
- Makes use of the framework's Accessibility service
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4584

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.IuUArrYHQmiA.gXuDiMTQTyIt/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.IuUArrYHQmiA.gXuDiMTQTyIt/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
68b150bb834a3115b8063015baaf038c

SHA1
d118cc8ed6b2439d7b047384111397e2ebaf6e19

SHA256
461805f4f251c052457cde622dae4f6a3d96fce376b5ededaf6fe3c30c090d06

SHA512
08e57cf640d7a747d8f6e2e40285fbdad992c9f671e81062197f4feb3c99432ff0b45f1319288f6baab0b3b62432897c8a3f09ad174d157266721dc1438a3d8f

Download Submit
/data/user/0/com.IuUArrYHQmiA.gXuDiMTQTyIt/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.IuUArrYHQmiA.gXuDiMTQTyIt/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
adfd5297989b7a88e28fa7a6a2c171aa

SHA1
cef424c207d432e2c04b8e7a122a2b146229835b

SHA256
2c0a4d8d2ebfba50125a65c01345b037ba95e753255c5a376a987d163c733460

SHA512
380e22a112e54c00e7dc2b5cdd00a69354bbb2b7f7432296dc676cbc9aa7ae5f9d20c781851049fc49ca2021a8c5e956509dafa9f80c407f614b6a0572b8e826

Download Submit
/data/user/0/com.IuUArrYHQmiA.gXuDiMTQTyIt/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
9a90e90495ff72754135be154468313c

SHA1
020fb55085a1f4ca58b8c3c6481467e201ca932f

SHA256
3f630ff8f9cd6c0e8b06ee79390f4fdeb01546ce7c1604a9a71c3bcd38bc2a13

SHA512
dc28121141c19a49d9cff2c23f5969b9bf32f443c58bafea460f90d0e22b37dfa2804e9c5b0450f27cb7f49a961fbea8ae18c9595638c6d7a7f55a6645a0cc94

Download Submit
/data/user/0/com.IuUArrYHQmiA.gXuDiMTQTyIt/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b04ce453372e38b8fefafeda7009d49c

SHA1
10fd00a2f4b10b10bf27e66dbdde5f55b3d08760

SHA256
d9beb1b2dbe056f3503d63e6a2c3137f680d6e6dc6ace40310b3d41d701020f0

SHA512
657bfc50fa1c87def246f60a8adb9b30c4d84a522fc9820cd3a36f6b629b74c8d21734791cd070f25df8161fbcc1ed4335095bfdedf615f9cb4edcb8cc82781e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads