Overview

overview

10

Static

static

6

a307e975e0...74.apk

android-9-x86

10

a307e975e0...74.apk

android-10-x64

10

a307e975e0...74.apk

android-11-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    188s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    11-08-2024 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a307e975e08ecea3f5ae03228a287e051208b1fb97470fc57d24981567becc74.apk

  • Size

    4.2MB

  • MD5

    fd42d4308cf151e2c0db5cec62eaf3a9

  • SHA1

    5ea25df3cd89004950d57bf3be0fd152650d2090

  • SHA256

    a307e975e08ecea3f5ae03228a287e051208b1fb97470fc57d24981567becc74

  • SHA512

    f3916b3aca7bda2f701fd21d76665ab66f2d6e8b5337e387ec969dde52d5d4e38d726d56222aa2f1aab6c403285558f625f0886a5a5bbbf18ffb4a078944e181

  • SSDEEP

    98304:Zv0vruQH77VbKRgczB+U3vsI8nJermp+A0O0HSh9L0TR:Zv0vvb7cRfIpf0O0q9LkR

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://193.3.19.40

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.oneiydald.ljvhyukgi
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4256
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.oneiydald.ljvhyukgi/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.oneiydald.ljvhyukgi/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.oneiydald.ljvhyukgi/app_dex/classes.dex
    Filesize

    2.9MB

    MD5

    8b86f1c6b7733d2ebdf6baf3835e7cfb

    SHA1

    1abdd3c1b5b897f0acf4416dc06d9ff45a264c5b

    SHA256

    26dddf251427e91250c94ab73c321a4684615d3bbeaf4591fdc503f69dc1a50a

    SHA512

    cff99c84b1ac49cb5bdc868960bc9194cfac48cc09c163c24ca70c31cd2e80cdf298ad2cc5f0f5bb1cfd647c28a6b988f62175080cf1f03acf970c041e7a7338

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/cache/classes.dex
    Filesize

    1.0MB

    MD5

    9bd19e677abd41357566f3a94f2b7d9a

    SHA1

    e469978a46d08db98182d217eea7220cda0c8fcb

    SHA256

    1ba5b9b51eae9fe9df296f46c5d9ae3a831ebb7515662bbba12d1d802e2a9998

    SHA512

    b7ac498abbcb0e6856453dd6baf4e8270bbc2270df4c619d3d14f43c2bc433471a6f1838623f50e44321ec4d0e4662daf42e3feb29302fd629dc7094e51e9c2e

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/cache/classes.zip
    Filesize

    1.0MB

    MD5

    8d2ce108ff303c1ac8d9afda53076d59

    SHA1

    152e12b78704e53435e727dd1e520c13c8e1f71d

    SHA256

    331538a52011885c4f3c3284acc768213458f701de49a6bc8525a12f5ac6a6a6

    SHA512

    fd8e3deb468158be5ebd1bd5b9202de9ce1edcddba57f160e00fb948ffde9e8115ec49372cf80fb9bae84edc7e484db4c0822205ad015383e3ae7671a6a58af6

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    787397bca040baf11d2e4da40cafc898

    SHA1

    ce4d5178d6830135460c3d59dd2a2c01d7f54d90

    SHA256

    c46a10e8cab1fc4035a1e607095b1fa62e64c5c8dfb807ace933545293b9fcc9

    SHA512

    21723a37b292e7875a3993e1103c4387816ae7145818539e829a238ad1a0f4806cee0c5b77a5e77c841133b824d4002ef32251583e4dce84bd90e8bc794fa266

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    25cb0890c8e30728e4ffb92495e8131a

    SHA1

    9ca630b7f5f452144b3ce60910d223fc21c1a13d

    SHA256

    f343c0a7d40171672add32db0804f4de467d1331cb943dd716e48d950be27b33

    SHA512

    67880006a7905aea664416ae1872b90619b77aaf0673b549ceae20a1d8f07e7e4e81a4fdc5cb7d679fafeed585116a63e18050843774056db1f085eaacee35c7

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    8787140e19c4b352f9b81c5d413c2e79

    SHA1

    de0cf6d8ee684eb5a6057b7169bb0753b60e2ede

    SHA256

    fd1532b102d41ebded6c997bef459e6c64c36e961169f4cb911c0f78364c572e

    SHA512

    6a7d609233dc1783fe0bcae4beb0472219d7e68441b1e030d570eb9db7c6403ce61bf6157ac1cebd72cad1f8f747fbc6a0e653a4d1c9b018583638da70853b1d

    Download Submit

  • /data/data/com.oneiydald.ljvhyukgi/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    00e0ed4a76b644b6e41b4ebfd2d25a54

    SHA1

    8ba33fae93319f7c9a1f8cd14e75bd5317bb2753

    SHA256

    a70574db7c0c853ce015346e679bc3dd6b0d915790610991f06397e20cb37ba9

    SHA512

    5fa3985a942c997aee85ac9a1ae19142a5770b381a20d7ef444aa0a1838fecd76ae431736beab2b1f535f72a8c8e2fe3b43965684920d9906354fe771c6228ff

    Download Submit

  • /data/user/0/com.oneiydald.ljvhyukgi/app_dex/classes.dex
    Filesize

    2.9MB

    MD5

    e8a04574e7a40651d4a4388fb8c51e99

    SHA1

    7d343d40dcab517bb5dcd024212cd33164a74874

    SHA256

    935e816a1e3c62d387ea33dee461801a3e1233add5912d107fe8aca4f1678ea1

    SHA512

    43705675bb0165278981dad0227d46a69abd32eba2cfa70e583dad9d52cf9867a92ea99d9d412a7c7cd34771f8473f312240979a82bb3e2ca98c25460a60f688

    Download Submit