hook | c8b2a6e0d3edc88fe573ed07d190ed4c105b5e12e56df935617654719cb6b45f

Analysis

max time kernel
27s
max time network
191s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16-08-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8b2a6e0d3edc88fe573ed07d190ed4c105b5e12e56df935617654719cb6b45f.apk
Size

4.3MB
MD5

2b0cfe30aad0e8211b3a5188e5ff1f1d
SHA1

bc5afddc506d902d928e5a1e983993de473e5211
SHA256

c8b2a6e0d3edc88fe573ed07d190ed4c105b5e12e56df935617654719cb6b45f
SHA512

97a36826e8a903eca0d03aea3b55c1cc1887855d82460f227c1defebe10c4086cf180ff1d3fbd67218b52c9391e9946a1715e394f656637d12ec9687ce1bc6a0
SSDEEP

98304:Swa0RpvHXxNAtHNZqza1ZqM3rp2hEwBBxmnLFtT6z3mtB4mB25QMQpAcbgDE4:SkvPAtyu14M3rMhEOBeJtuz3mDx2oA+I

Score

10^/10

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://poqw1zxmn.live ; http://ewr2ionmxz.pro ; http://xds3njsqop.xyz ; http://mnj4poxsrd.live ; http://swxmj5io.pro ; http://ioxsmjr6r.xyz ; http://xr7mkokwsq.xyz

http://poqw1zxmn.live

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.hzbovooov.jnfdqlmff

ioc	pid	process
/data/user/0/com.hzbovooov.jnfdqlmff/app_dex/classes.dex	5038	com.hzbovooov.jnfdqlmff
/data/user/0/com.hzbovooov.jnfdqlmff/app_dex/classes.dex	5038	com.hzbovooov.jnfdqlmff

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hzbovooov.jnfdqlmff
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hzbovooov.jnfdqlmff
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hzbovooov.jnfdqlmff

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.hzbovooov.jnfdqlmff
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.hzbovooov.jnfdqlmff
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hzbovooov.jnfdqlmff

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.hzbovooov.jnfdqlmff

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hzbovooov.jnfdqlmff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hzbovooov.jnfdqlmff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hzbovooov.jnfdqlmff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hzbovooov.jnfdqlmff
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hzbovooov.jnfdqlmff

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.hzbovooov.jnfdqlmff
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.hzbovooov.jnfdqlmff
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.hzbovooov.jnfdqlmff
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.hzbovooov.jnfdqlmff
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.hzbovooov.jnfdqlmff

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.hzbovooov.jnfdqlmff

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.hzbovooov.jnfdqlmff

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.hzbovooov.jnfdqlmff

com.hzbovooov.jnfdqlmff
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5038

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hzbovooov.jnfdqlmff/app_dex/classes.dex

Filesize
2.0MB

MD5
2c847654bb53ca897a99f8b130aea7fe

SHA1
c20fcdeef35fc72b5328ff660d08370da4ac7a18

SHA256
466218c0512f103c886ff6a3f603b09f7f1442c0447dad812a8bde84b1782ea7

SHA512
e77e4f94a498263374f821d722899637b97474f52c59335663a2c88e8139b0c1d24dda05c60df4b06315482ff87c39171a185ab0151e76522d3049b82e32ae10

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/cache/classes.dex

Filesize
985KB

MD5
39c7ebacd30c09f0c355f9e02b8e6529

SHA1
985119b6544344492a755ca8b5310d165a82a199

SHA256
f718770df6a8ef57aba00e09da8de8fc7c703e47bd51c45269888007647eccec

SHA512
fa6abb2b4bddb38e24c4e378b00533b0a6254edb0ab3669464ddd367165a8884bfdb5e14395f74f70306a61faba15055a15f618f698c7730273dfc079952f43e

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/cache/classes.zip

Filesize
985KB

MD5
dae7da523f279a3f77960efd529bfc08

SHA1
6231f9f776472dccfa59cedbead8d4e3bfa2b7c0

SHA256
5921f8e059643e1f48fce35094b48ce39a9ad4f7ea42917ab509507b42323dae

SHA512
f310dad5316526251b2ad088f0ca1149b9649d91f3aa9def6f11a0d0077efabab562f7c9a556230f212139237734175a7731d7df56ed70ea15b705863880f12f

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e9da06a31f69965ad40cd694c26229b8

SHA1
a7814c338bd8d754c85cbc908a22a2b1eb237c35

SHA256
13ec268ce0e9ecfd7eada133afd70bc802e15c4d8f0b8ae1de9eb53fb5dcddd9

SHA512
d714b0f016a9dbaa9f457a45791d17ed304433de7c41b9e8f4221dc8ac96513789fc346f7d7c4539ad78e2dfc3a697357054a3a02960195f82eaf297af9b2299

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
b63c25471ff5bdbf0c699b043884f9a9

SHA1
512a3d0511ba35db55680d0940bdbaee889f78a8

SHA256
d7d602dd42bd6f8c7ffd2d14a01277937ce7b7322c99240f6191df32e980d206

SHA512
2706577a42d3fc08a380adf2baca243a9038915ca4e1fb7005c59e00ee790bf2c56b10d6f4f3b63de86d288dca9472bf38531fb7d92b31b34016d83522c3f4e1

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
6772be7d75070387699cb6434864ea4a

SHA1
39523a3bdf97888d2f15c287cae4129edf6d92dc

SHA256
fe95b0fa221360626df440c5e7ee2a7a7384470610cb5adbb45d875665aa31ca

SHA512
44f480dae989cdfe6aa53452368add9f84d473e913dfcd5f60ad1d63eb738357f3ed9546d80153f43b0f7f6bcbf631562e0e0214c94c23c109bd78836c17ff4a

Download Submit
/data/data/com.hzbovooov.jnfdqlmff/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
950652c11faa385d50a23e487ad1ba91

SHA1
e87dc9384251f3c5c45b3ae5f0fd2be1600137ba

SHA256
3919d261f5981dc7b3bc6c418db10f9fa2a3e4b09e81216849689e2c3b00efee

SHA512
c393b7165640a65b3d96ed62d1633ee136551190613c7f36180fa5e599e19b8fb81fa1b4f24b7f228c1d1f9f4826428c1caa17ec01a8e03e1fac71109969bde1

Download Submit