hook | 7c5b8ef2ef5755e0a981910792be222ceade41eb99235df3b0010b65dacc6cdd

General

Target

d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8.apk
Size

1.1MB
MD5

86eb8c78cf477ddc6638da4f4271bba7
SHA1

41e25c4c13458e192828b45bd764e3847dbef92a
SHA256

d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8
SHA512

d67b1afed0897253aa7a91183526de80d28f9e5b4df2408170f7787fd56011655beaafb42c9ac1f62589601db438d93b0603e7e99704bef29cc5760ed7eea4bf
SSDEEP

24576:zD3rm/4IsL8HQfIjPjSv9AzC2M3jXdiV551DOup6U/Ujy1Zg/g56wQ0:nOS8HQfIn1zvM3ZiV/P/L1Zg/50

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yogadisodoxatuse.fapeze
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.yogadisodoxatuse.fapeze
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yogadisodoxatuse.fapeze

Prevents application removal 1 TTPs 1 IoCs

Application may abuse the framework's APIs to prevent removal.

evasion

Prevent Application Removal

T1629.001

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.yogadisodoxatuse.fapeze

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.yogadisodoxatuse.fapeze

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yogadisodoxatuse.fapeze

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yogadisodoxatuse.fapeze

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yogadisodoxatuse.fapeze

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.yogadisodoxatuse.fapeze

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yogadisodoxatuse.fapeze

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.yogadisodoxatuse.fapeze

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yogadisodoxatuse.fapeze

com.yogadisodoxatuse.fapeze
1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4372

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
2d8445d7eda2988573cc62f5cefb49e6

SHA1
9ea681bd3d0e5f15d4a9dcb5cab4019aa672df12

SHA256
7dd382e1e90c49536c16a0fc89718a87f840af490dc5e4765fdd2c80f24ce8c7

SHA512
9f34b7c182406ec115bee26cccc1da9933ae14019f0772a29a027a300bf60318192ccdd5ca81d05c6b0c69183dee8c10e69438c1e3d9930b6594a64bbc4a7df4

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2ba974ccdbf38227fa001c73fc3332be

SHA1
4b66f03f6cdb86e2550d9f8c6e272ec95bd483aa

SHA256
c9ab30e1f32a108b071b471101ff7324d00ccdbc7b6aa1b44d8dc8e5df332b98

SHA512
4748db7a9f5ae7c2175635dc91d4436d0b4113f1097490cee038991d860578a89d0af05adf90516cedb8f287a7e2fc5f3999db434b06ce262b6b67a17d0ba3f2

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
b98c21acf505eb504c28acd9d3a882fd

SHA1
14cb5488ef9ab2a4ddded324688fabaafef0dd05

SHA256
27d84ada4756130a5fbd2bfbf8f8494fd592d4c92e11effb6b443bd63a74f773

SHA512
b7cea576313481e5b62896f226b793d3ea1edcb233fd10dee3141ec8a36fc1ab87e8965dab930aa46a13bf235086fde8b9aff7723a9c7789c65bd180fcf3b708

Download Submit
/data/user/0/com.yogadisodoxatuse.fapeze/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
0c5f10feedae7a64095b1e2f5bc59bdf

SHA1
0414f9fb8a50445ec59951212257e6c30051e534

SHA256
cd0188ceca292b140362d7265fe43f41ccdffb00d8b582dd017a794574270407

SHA512
1f81eb79ffbeec164d0f7864c19895c6e3415a4bfd714533b524e339d8e83f422b5335d9a28fd2eda296c06905d2e79f754666b7473055aca88b116aada92d96

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads