hook | ebef35a1c187bc6c42783e310479c03114ccf86d1aa8edd6dd8938bebffbc4bb

Analysis

max time kernel
55s
max time network
170s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
31-08-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebef35a1c187bc6c42783e310479c03114ccf86d1aa8edd6dd8938bebffbc4bb.apk
Size

4.3MB
MD5

bd8aba4e9767ecd40c6c8c8b6bedb8dc
SHA1

c269a1176d94a46dfcac8dbf6a437df7218b1f49
SHA256

ebef35a1c187bc6c42783e310479c03114ccf86d1aa8edd6dd8938bebffbc4bb
SHA512

951b7b0565ef60e0f569456d329a12199883e799edc0aa8b8c78f78672e8b51a352b9d4c792fd8ada233db7cca7fb86e342bf6f9a0034e694b5227e82ac355e2
SSDEEP

98304:XvkQDKUon+CJ1Lf0Kc3lUSwqm1Sfdu8ibxbIdNy54Q90Hpx+:Xnxu7J1j0NVUSwafdu/bl+Y5Rkpx+

Score

10^/10

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://80.64.30.193

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.nvrfyhgnv.dpamatira

ioc	pid	process
/data/user/0/com.nvrfyhgnv.dpamatira/app_dex/classes.dex	5046	com.nvrfyhgnv.dpamatira
/data/user/0/com.nvrfyhgnv.dpamatira/app_dex/classes.dex	5046	com.nvrfyhgnv.dpamatira

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nvrfyhgnv.dpamatira
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.nvrfyhgnv.dpamatira
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nvrfyhgnv.dpamatira

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.nvrfyhgnv.dpamatira
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.nvrfyhgnv.dpamatira
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.nvrfyhgnv.dpamatira

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.nvrfyhgnv.dpamatira

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nvrfyhgnv.dpamatira
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nvrfyhgnv.dpamatira
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nvrfyhgnv.dpamatira
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nvrfyhgnv.dpamatira
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.nvrfyhgnv.dpamatira

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.nvrfyhgnv.dpamatira
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.nvrfyhgnv.dpamatira
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.nvrfyhgnv.dpamatira
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.nvrfyhgnv.dpamatira
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.nvrfyhgnv.dpamatira

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.nvrfyhgnv.dpamatira

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.nvrfyhgnv.dpamatira

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.nvrfyhgnv.dpamatira

com.nvrfyhgnv.dpamatira
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5046

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nvrfyhgnv.dpamatira/app_dex/classes.dex

Filesize
2.9MB

MD5
aa958b93f83cc2209b8724fd0e4f1529

SHA1
33b50f7eb182349d2945efcce8e687913c9826c2

SHA256
b92fd70d5eb2706208e8b71565b3ba7097cfa6d12b31d8cce10f798bab32fe2a

SHA512
2b3528fcf3089a82255ab106ed23e5633568d0b4f62a08f788bc4a42c90c6d6c56d8926820196fcd75296d350126d038ef570ad89a5c3f9767cbc3a81d8d744b

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/cache/classes.dex

Filesize
1.0MB

MD5
b3d80764c639f5191ea60b37e5d3fd6b

SHA1
db9b4acffd15e5072f786b8cbbbca640121ef056

SHA256
c2a251b5ffbc19961f524040b1bb4b55adbcc62f59bdfe2bccfb2f0a96521deb

SHA512
ba9c8f74466a6e85300cee3d0d80f9d40526e586166f4053e4799e7927dfe460c7e777c34d0cffe0197aed07127f852bcef7920a89b4a9a6b1e005e27b315028

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/cache/classes.zip

Filesize
1.0MB

MD5
842cdd8bcedc5cadf1693d6151a7096f

SHA1
ff002aae96c5721eaba558e9c2142deb6b9ecf37

SHA256
1afe2e86aa781d3cc40b7a86b53c6805e93d3b74d35009f3a3b365162d01d560

SHA512
dd995db6a4bb62a01198abf5f66ae6a63d07d5edfd6c6cbada1211d32425086d1be8c82ab1d4ba7b06f2c85ccf2768e4c9fe629ddb8623c6af0773ec54549c7f

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e91373b2a14d5beadc2a60cc2d533d66

SHA1
8f411c68481f1450d1f94ed059a286af82a45769

SHA256
a32d0f678e5e271731131fed4deb430c21c752b76b38839177b596c33f1be3eb

SHA512
1bf331476cfe3d00aebb50b6680d9341a9e8f275d3532725d7a34b52327b6e131c9daecd677e3e0125abb0f7894cb808710ac06e0153724373469f5272ba9162

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d9238214c685a68f8f1afc309f503175

SHA1
fef1f41362577096cc5b5454c8bc8730099b1794

SHA256
dce09865ffabd7104c16188c6eb75b23a54eee55e1470f1fa4c57cfdcc256d5b

SHA512
4b77b8961acdda1b8fb440f7eaabda9e4eab908b22515ad9a5ad620daaea21dc76fe99b38f217d1c49a84e74823479017b2918a5a6b897ad2dda2bdbc232b874

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
dfcb110adb0f458459e961dd0610ac54

SHA1
bcddaefca06a5618857c69b2d1889a3e1cb3f338

SHA256
f61909e34d6cf91cf45d5dc6d8d93271bcf71c061a9bad475cb5c33245b8bebe

SHA512
d5382ada56995dec4ee2f613c8a07a128fbb0b53cecb256c24ce662a062205f8b378eb6683f37cfc30e9da03c2363361bc69eb51b0bb6efdb4064bdbd1c9b853

Download Submit
/data/data/com.nvrfyhgnv.dpamatira/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
060ae37c114703666afc4cb125115685

SHA1
e29467c049a7ba664842bf6c83ce2afc9c0fdfa6

SHA256
35a98a124b81d98a1e186753b403099d7b60a4a196db531d9923c1eb5a7d01ed

SHA512
e952ed0e29d8521955fc1cf095e63a6cf6b25e8ce094f234ac4ee6da0c05a9ac6bffcc0a7293f94356075671719e00fa5f3b137ae68901123b5b1bdfad369b35

Download Submit