hook | 697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0

Analysis

max time kernel
155s
max time network
144s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
01-05-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e07fd729182650c77f29293c6e4522c5.apk
Size

1.1MB
MD5

e07fd729182650c77f29293c6e4522c5
SHA1

9e0c183e6ef61953cea9d29bf4fc6ea2cbd8a164
SHA256

697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0
SHA512

8673e7b983773e58f83d4a75b7a7cc7dbb6d0bfcc16d47848800cd491fb224880e1867fe198ac35f3dec496f2154a5792539bfa2e27cb557336331379e86dca7
SSDEEP

24576:sbKs3t7YSbMlettFATgZYfw20V/ojyx5g/Qn2q:zW5YSRFATgyfw2E/Xx5g/7q

Score

10^/10

hook collection credential_access discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

T1516

T1513

T1417.001

T1417.002

Processes:

com.lexohiludulefu.jojuxewu

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lexohiludulefu.jojuxewu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lexohiludulefu.jojuxewu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lexohiludulefu.jojuxewu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.lexohiludulefu.jojuxewu

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.lexohiludulefu.jojuxewu
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.lexohiludulefu.jojuxewu

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.lexohiludulefu.jojuxewu
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.lexohiludulefu.jojuxewu

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lexohiludulefu.jojuxewu
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.lexohiludulefu.jojuxewu

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.lexohiludulefu.jojuxewu
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests enabling of the accessibility settings. 1 IoCs

Processes:

com.lexohiludulefu.jojuxewu

description ioc process

Intent action android.settings.ACCESSIBILITY_SETTINGS com.lexohiludulefu.jojuxewu
Acquires the wake lock 1 IoCs

Processes:

com.lexohiludulefu.jojuxewu

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.lexohiludulefu.jojuxewu
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.lexohiludulefu.jojuxewu

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lexohiludulefu.jojuxewu

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lexohiludulefu.jojuxewu

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.lexohiludulefu.jojuxewu

description	ioc	process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.lexohiludulefu.jojuxewu

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lexohiludulefu.jojuxewu

com.lexohiludulefu.jojuxewu
1⤵
- Makes use of the framework's Accessibility service
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4378

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lexohiludulefu.jojuxewu/no_backup/androidx.work.workdb
Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.lexohiludulefu.jojuxewu/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
3986b963a587581d18028232b7c75b12

SHA1
06e857ec5a627b03dc266b5e62775e0a0a84c511

SHA256
77f0e0c99d344e7d059f4db0fca3eb8cee453aca063b629f271d1b53d260d15b

SHA512
a9772adf60ce687069891ebf59de02046eaf295adc45fd95753dc78d8f6bd15f2f554199e511ecc04e5a97df6e6bad1f331efe99361b50bc03b8bc6a3dbdebb6

Download Submit
/data/user/0/com.lexohiludulefu.jojuxewu/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.lexohiludulefu.jojuxewu/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
20c47ea4ffcb5b58b4f925fd239f776d

SHA1
4f32b45b4ecc9b8bc3779d2c045634f65c90abc8

SHA256
72bc6746991007252d1767d0d151de9b1cc236ff822c34e3b59eb5712a5bac4e

SHA512
a50a63f3c901fd8b0c02da8ee74e68783e47cae63eb0423698f1696ff3c1c43c77e30492a3639289122845af445d80cdcbef173de2cea298d7ea663c3639af81

Download Submit
/data/user/0/com.lexohiludulefu.jojuxewu/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
b321cc7db10730691436b07be48de63e

SHA1
7b4841306338baa96baa9c564e6bf6475f76869c

SHA256
9f6ae5a60be6640c027b0546484701f68fe7d066e7c51c795b51347c7b6ac0d4

SHA512
47e552f7083006771179cafdd8bd5af49fd2926b7b298793927b01b80bd7c3d35891d335a7348ab9aae7ed596539490e7365e125b9045d1a52bb0dee2b018e88

Download Submit
/data/user/0/com.lexohiludulefu.jojuxewu/no_backup/androidx.work.workdb-wal
Filesize
173KB

MD5
e93a0ea10d348f0e77d7c490cace6af7

SHA1
829a217df4e4e1645bce70841a4c40d5b7535f94

SHA256
11399fca634508f0029609d35a4b834a8c319786ee11d93b4eff809a005a8e50

SHA512
f0d1ffa000fcb1aea789295d8f6f78b436775e9c1a620f4f9ff296221c240148103d333b99eed529f524a10ddb2490291fc8950e5669331b8f90273f03e3891a

Download Submit