Overview

overview

10

Static

static

6

f4aa091e7a...af.apk

android-9-x86

10

f4aa091e7a...af.apk

android-10-x64

10

f4aa091e7a...af.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    10-09-2024 22:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f4aa091e7ad26030573b337504f629bb23a183ad9e229d1c0d49f3452db6e9af.apk

  • Size

    4.3MB

  • MD5

    e4db988325d5cd27732c83de97dc3ca0

  • SHA1

    748580afb97646a453f81c4c05ffdb8111b9fb0a

  • SHA256

    f4aa091e7ad26030573b337504f629bb23a183ad9e229d1c0d49f3452db6e9af

  • SHA512

    6031e1857c2b4c0b8df05d229f89bd1ac67dc7989880cef23ed2ae944d2de4f2802f5f06cc55a0cdf2e862bc5fbeaadd9e3074378a04b0ca372885f2e8da6f8b

  • SSDEEP

    98304:4Ia66C3aiYw7VGLJUXbtfF4gdAyEIvki6bTHz33CcbRjM393Om/l:4Ia66C3aiYw7QLgFVfq1zHzbNM4mt

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://vbh1hfye1gf.live

http://nb2hgj2ui.pro

http://ssd3ffg3rrt.xyz

http://xsd4rfv4tre.xyz

http://xcv5vcx5rty.live

http://vfgt6re6tghj.xyz
DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.brtqygziv.kfnjmzbqo
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4282
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.brtqygziv.kfnjmzbqo/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.brtqygziv.kfnjmzbqo/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4310

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.brtqygziv.kfnjmzbqo/app_dex/classes.dex
    Filesize

    2.1MB

    MD5

    25b17e4c71e728311192c092d1e52738

    SHA1

    709d42f2bec91b6ddbc2867345e17b023bef04d1

    SHA256

    e61d8d01d204bf3fa62abbc5dbe6354fa4a29f9957a465c3ec7a2ff454cc6c80

    SHA512

    3bdd193fa13901853b59bedc654c61d933121d5e4d5430b52cbfe347ebbc5cc0f79103bb1574c78ecf1ca6bb95720e3f8318ac8279b7f4c4f0ff19a1d81eae66

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/cache/classes.dex
    Filesize

    999KB

    MD5

    aa0d40ae41515ebf050afc1288656a9c

    SHA1

    568a8f2c0483ec701874de9f520669b4a3f34807

    SHA256

    9a1183abfc451cc6cd5c668b5264a3eb04685fd859ac2817d11b58983dbb2af3

    SHA512

    8c9262a849113862459a0c57ec85204de328a176d320f97663eadd5896b652473261c009e6f07a1c270a093cace18f47a13bee5bd11551c781c404e41f2cfc31

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/cache/classes.zip
    Filesize

    999KB

    MD5

    2286fb4f7d4438b61b354733927b0f45

    SHA1

    ada391fcbc88bb5ebd58258504f6fcf92bc5b4a4

    SHA256

    d2f1ef6d1dee9c7729199ec4dfd4eb82600e2bfaa68a58705001bca6540f059c

    SHA512

    ee4b4619b34bcd33fc8c61aa66f5c7cb1f1f4ac02f4a831b3c286c0ebe75ccdc5552aac7aae9d5db613d3528801fb90c45b3490924b7ed8a140795aba0ffa3cb

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    9cd962fb7593ef881efa90cbc08609e9

    SHA1

    8036856614fff37138b7f45f6bfc414b49431469

    SHA256

    c76518f82c6134fc81ea3825b888190c381cbae4796c7cb00ae1cf06ae81ba9c

    SHA512

    2f233a9e6e146d8ea49328f590070e49389519e1eb3eb9f1dd0ee546a1a8cb000aabf4b3da35ff9ec435944ac398e18f27ef151fff0a4fb87cbfe709261e610c

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    ac89af2e75e17bd26d4744af78fac52a

    SHA1

    1f2bbd74e54434c60741eeef69f1c2aa2f233db4

    SHA256

    be0dcddfeb6a0bae8b6297b9a0f8b464eecb3421f8e92bb55552c26018aeff2c

    SHA512

    c709fb2c662e1e24b8c10f12c07bd96aa5944ee180786bb9df27b5c88ec7cc1d54306b81e26a4e8869fd1c08b2149efaeab7df3baaf939bca37eada7fd1c235a

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    0a962be4d705260600c83db4d0a2a47a

    SHA1

    29717f30c82e6c52aa1219833606b6b393222769

    SHA256

    76df40a10433ea4bff4fddd8cecbd57fe864d7490f51699256e5f76dd1a7f2f4

    SHA512

    c0b10c40cadc1c085a6f342724744dff2991b5fe5c6495a74fe38113c5c338cfe69b551b52d0b8fa1a36b291394b0a01beae5a6b4fa3c97420fa5962b0113f1c

    Download Submit

  • /data/data/com.brtqygziv.kfnjmzbqo/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    36413e8a8d8b3b84e18579a00007011a

    SHA1

    9a71ae1388534a8bc3eaf56f47a3b985ede47aef

    SHA256

    c8162fc288a7136ebed85fba71037edc9d6bde8638dd4762714f3fb6cdf303e1

    SHA512

    5820fdc07dfa163e46e8caf346cfbe6e473cba5a549a2487df7a3f38dbcc14faa0fef85aff77f8f7ad5d573bf29f0e35a89883fab03f5d633b63ef206d3ea3ef

    Download Submit

  • /data/user/0/com.brtqygziv.kfnjmzbqo/app_dex/classes.dex
    Filesize

    2.1MB

    MD5

    83efc3e1deccf6ed35296390880e6d88

    SHA1

    5d908cfc1ead5ea2cb34b8938f9e5d20656a1e06

    SHA256

    baeb3ba9cfd7a90bca1ddc8e81b29c8348d8743f954073d07c881eda36be9a4a

    SHA512

    73cfbc4ad584dff2a8327375fd9d3ab3a42a1cf0872f444d65686833573df1062c6b9120c86fc5c2b88f95d426794d60ac68987e4e3affe1849b3031951c492b

    Download Submit