hook | a1d8c0dd55e1d8bb887e315f8089208ba552e2ca298bc16247ea1a583705360e

Analysis

max time kernel
163s
max time network
189s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
21-08-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1d8c0dd55e1d8bb887e315f8089208ba552e2ca298bc16247ea1a583705360e.apk
Size

4.3MB
MD5

9ee4c02bcaebd64f5f26c477b2280b99
SHA1

7c148e660ca0c6f0997f59e4c74d684d42ec6325
SHA256

a1d8c0dd55e1d8bb887e315f8089208ba552e2ca298bc16247ea1a583705360e
SHA512

14cd98c1f8ca879673a53f4283f53fea7b8d98bccc0fd4dd994b04fd46de157167047beb56bf9112c882d4e5e6dca1ea55a98fed02c38f8e736f7046181885e5
SSDEEP

98304:NESNZZnj/3UlpvuLBjRgfrQB+giaLVtOvHxaqCV3UTCMEnTdFRq6:NXbn7AKBtKFgiuVEvXCVY6pTt

Score

10^/10

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://149.50.108.117

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.ovuknozlo.dqibqmypp

ioc	pid	process
/data/user/0/com.ovuknozlo.dqibqmypp/app_dex/classes.dex	4618	com.ovuknozlo.dqibqmypp
/data/user/0/com.ovuknozlo.dqibqmypp/app_dex/classes.dex	4618	com.ovuknozlo.dqibqmypp

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ovuknozlo.dqibqmypp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ovuknozlo.dqibqmypp
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ovuknozlo.dqibqmypp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ovuknozlo.dqibqmypp
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.ovuknozlo.dqibqmypp
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.ovuknozlo.dqibqmypp
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ovuknozlo.dqibqmypp

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.ovuknozlo.dqibqmypp

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.ovuknozlo.dqibqmypp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.ovuknozlo.dqibqmypp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.ovuknozlo.dqibqmypp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.ovuknozlo.dqibqmypp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.ovuknozlo.dqibqmypp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.ovuknozlo.dqibqmypp
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.ovuknozlo.dqibqmypp
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.ovuknozlo.dqibqmypp
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.ovuknozlo.dqibqmypp
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

File opened for read /proc/cpuinfo com.ovuknozlo.dqibqmypp
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.ovuknozlo.dqibqmypp

description ioc process

File opened for read /proc/meminfo com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ovuknozlo.dqibqmypp

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.ovuknozlo.dqibqmypp

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.ovuknozlo.dqibqmypp

description	ioc	process
File opened for read	/proc/cpuinfo	com.ovuknozlo.dqibqmypp

description	ioc	process
File opened for read	/proc/meminfo	com.ovuknozlo.dqibqmypp

com.ovuknozlo.dqibqmypp
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4618

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ovuknozlo.dqibqmypp/app_dex/classes.dex

Filesize
2.9MB

MD5
47089e28f049d6d333d643795124dcc1

SHA1
f0edf0c1b1ef0bfc2c70bc4c3c55c881e1e17d22

SHA256
c57665652c38ad124084fb9ce6eee2e30bf0c7beca6a46da7b4590099539ae47

SHA512
d29da054505612003f963d177f3d03345e4205bc593f527fe379827e4c37a737ef25c85b72f82ef679836cb415a996ea1aedd846b2305723e578e9adfb2b600d

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/cache/classes.dex

Filesize
1.0MB

MD5
e4cc0c2a8795010a344d3fe9d295dfa0

SHA1
f7395885fa6a6e6718377485dfd1600b9c0e08a9

SHA256
ed92ccc308adad9ff9517b3cb9cf5196911867531e7484f26669442bad44d865

SHA512
94ce3d3e9235b066e6adce2561e770d0a167bd6854128f6455097e1a53ece827ecb3fb67bc0c3c686a82c58eea6296a111f80d522a8ce14cb3746b62ac143b66

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/cache/classes.zip

Filesize
1.0MB

MD5
da8683d5f81f9d008ffe3ebda018349c

SHA1
6f4c742c349ed34112ce745fe3276170dbdaae08

SHA256
e72a8068d1cf07e1a6d2ce381eb3ff6dff9296010773b3c421b080f007867828

SHA512
0df112997b492d114ff8134e56d27747f32341aaaca04ca301e65535fd3bba83007d2a5dd757fca46d49ec31270020f16e4720d38fd5a5697ba206ce3bb4f108

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cf63cd4036e462b01cd32478d9aa299e

SHA1
f32e9d0c53549f226bb5e5ec4baa3a10d4e113b0

SHA256
a233f8a4f02a1e147362fd28f4a7a4ab929387fe06470c11f9a683fb4df4a7ea

SHA512
0238ee7734e5ac711e384f7790f645c5bde11b59e3093133b217c7ed3945cedabc957c839520d43718546c140efd75c3b0311ed7af7ee9837eddaab715ade27f

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
9f261d9d8e8f471c315b6fb7fcb21a70

SHA1
3893fa874d2ed0eddafb37ed620cd4c6d452e3d1

SHA256
f32e3afee0c45a5e8f0b3875079ce4da04b29a3215a98dd93b2df011f8c40dce

SHA512
8f464862cf9efbe087b97bdbe53a5b91e22ec808389b87699a37165a98e879b26b6973b40140c654568f35797e8c32f44c989f1de04938ac6e4a4b8e43e68e82

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
b998b035b3f91bf49c243a69d96f4331

SHA1
45e1fb5b9e7dd2568a1955a57606797aaa33c2dd

SHA256
5c1ef558df940856f9696616fd2b7515e9246c16b52c33fe3910875519492ad6

SHA512
75934e3f28c1a3d81ab09871a88a2328f3fd61aa0649ea7d4b0869eba9ffd81c9fba26112dba869a01e5d35dd7cc4d4fac16b2c8cdf34d6b632ac2390e9bb4b4

Download Submit
/data/data/com.ovuknozlo.dqibqmypp/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d0c892adc6d219d8a6a53c6ffb031219

SHA1
2c4a5f4a93a4a0a55342adfe766eb0dd986c6ecc

SHA256
9d2498347655699a5aa1bbcf966d37e9d21f7f88b844e2197fdc32d357fafb9f

SHA512
126242e25bd011ef26809818ff61906f2f7c38eede068cd79f2bcd8c1a4fa3ea8b37477b19a2b1026c67c36d344d7fb7931e64be47558012a517f49a7e382150

Download Submit