Overview

overview

10

Static

static

6

7092a0a9c8...b8.apk

android-9-x86

10

7092a0a9c8...b8.apk

android-10-x64

10

7092a0a9c8...b8.apk

android-11-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    196s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    16-08-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7092a0a9c8fb77919be304b32f30f1c117c874347a3abdc459b933dcc5a0e1b8.apk

  • Size

    4.3MB

  • MD5

    7f26ffde8f6049e40018e3898c537dd8

  • SHA1

    cbad61b35a5e2f4f6e148a09de7f49f1903e88f8

  • SHA256

    7092a0a9c8fb77919be304b32f30f1c117c874347a3abdc459b933dcc5a0e1b8

  • SHA512

    6d1a293800807b13dd84e1fa80aef2af0564fbcd1d8e1e682f75f3c016b50a5630c0100bd681640faab29747fcc91bb428cadecc77d4291614e69e5dd60ec6ad

  • SSDEEP

    98304:dHUDd8tHdpUeRktv6RYQstbe96BoP3G5C6YtG:d0DUd0tv2YtnBIAks

Score
10/10
hookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

hook

C2

http://80.64.30.149

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 9 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.svmzvvxeg.ikxwixmgq
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4280
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.svmzvvxeg.ikxwixmgq/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.svmzvvxeg.ikxwixmgq/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4312

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.svmzvvxeg.ikxwixmgq/app_dex/classes.dex
    Filesize

    2.9MB

    MD5

    a03cd805d85b7e3b78bf0876659800f9

    SHA1

    c1f601fa4689ecb3bff64d3e3129458d9b2d247e

    SHA256

    4a5d61d7d87cea4877ee74a8e3eb88d0df9368d13d5e143a46236a4a6d5a7252

    SHA512

    b4d929bc61c70a9ca4abc59f5708e90e281bb5239799bfee524f2c20be52e4c31acc60221d2f18f3479b2da175709aea450917566636952e9146c993c8452f7a

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/cache/classes.dex
    Filesize

    1.0MB

    MD5

    4467e222f8aa4929d242e2e64583b6bb

    SHA1

    e8df27bec69231e2cc54ef1a89a253a6b4f416bc

    SHA256

    fc25c6e7c969bd956e23c792ef7dfb436ee98aa41e03fc87d1728a48f47331b5

    SHA512

    47912e4cd90933fded308eac9558277f1cbae0c26fd934c928d3e3044c1edb2e54b0428b4834cb4638bbef96324718dcec462e776cd49ecdce37f20176eaebcd

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/cache/classes.zip
    Filesize

    1.0MB

    MD5

    4c46ab45bdb0de666f61170cdf8cfd78

    SHA1

    15ba7a31966b70e9226b7821d64c87f04ff5db16

    SHA256

    1b8464ddeec4b13d36cdf2c7d5a45d42cce9b51f547196af8b3a22c7ab8a61fd

    SHA512

    8956fefb392164b53f011409d96c826222e92c3219bfc9d9819f2363b43fbd9c7d9be780ff89849c4874f6cce2254bf135a519cc90def9ecb983de5d0e6c9f86

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    c2b3f26c8863a32ac9e0d265eb8c4443

    SHA1

    72da56e3ca8b5f29fa8e2e358fdafd9d22965fc6

    SHA256

    ceffa461c85d0ce497aef1d9f65333fb1aa1cbc43bf0168862496af16c7e3857

    SHA512

    6dc89ac86205e375b30f4789769e54eefaeba39a25e56649e9c9c97ac9fb84f7c7b54f7b6d79d3d236812a17ac123f033e5a0dd4918a2eaa2b9f235f6d34341d

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    88ea895b5b7e5d53bc8aa64b43a93155

    SHA1

    0621b29f933d33aa9735b61586d3441c2bb30b18

    SHA256

    7bc338fd30bc0fdc74a034422ccec1a1c4caac3a977860891af6212acf4cf84b

    SHA512

    1926ff8244cb912a3ec00043f7018229ea79377c9f828d4501605260f645c41d3d44291927e32cfca23046e68914a812eee5d0647207ad798d2a2b4a9d1c386b

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    6d2c8532630331d759b5e18eed0c9ad4

    SHA1

    00d9ee28fe83f69f304b6664e35697899fa2024b

    SHA256

    1d81a01df9877a5d370685c7fefe38b20135fc73ee2baabda988d566f9391250

    SHA512

    329b24675e9c553e7d99286e4777704603c47244d4f6d5251c10f1d49dfd10222744ebab76bd62fa103b753ca895dea33250de393caddada931c46914c39ac28

    Download Submit

  • /data/data/com.svmzvvxeg.ikxwixmgq/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    2f2d8635a82b6be7aad70dd055d4c877

    SHA1

    7e1279cf2e003771013c0f4fcbae233b23a91dc9

    SHA256

    3d3e8723fb6703fc029e6ba31c9d4dc753ec2f4f33252e063faef7475c5a802f

    SHA512

    4b788a003cabae69db84eaa569f2e111e3e96dee8bbe7c0de560762403d577cff1d5966012c79509c095125e00f4558a5fa6500640b8051d0f75e99582710e1f

    Download Submit

  • /data/user/0/com.svmzvvxeg.ikxwixmgq/app_dex/classes.dex
    Filesize

    2.9MB

    MD5

    e39fa3536bcc7402eb09e62dd0867a38

    SHA1

    f0d8b19dc50342a6d76800068ae9d7777061d914

    SHA256

    d2f7782b040a03e5976f6ff9cde03fb1b271eed4ef9470f3d440fecc1155371e

    SHA512

    aabb4fa5a461a9b134fbfc821d59285a41a19881d23d2d75a6fbf9e2a770f876489ddcdbb4619261650f863d93cb0b2c0cb9f1376e52888d5287e9ec060cdd97

    Download Submit