Overview

overview

10

Static

static

6

ddf3a46d27...41.apk

android-9-x86

10

ddf3a46d27...41.apk

android-10-x64

10

ddf3a46d27...41.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    18-10-2024 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ddf3a46d2754b84ed30e77b519219262d3334031552d5f582dec33017edbaa41.apk

  • Size

    4.3MB

  • MD5

    5cb007bc21cc46bb930528cc26b91dd5

  • SHA1

    c9d7444d4d0d82ef678b98074fea6db4662766f4

  • SHA256

    ddf3a46d2754b84ed30e77b519219262d3334031552d5f582dec33017edbaa41

  • SHA512

    b1117d6fe890856c15ce6f28f1b2aa279da92d109f444c2f991efd5396e00ab1b75bb4ac6a368e08cc5046745ee62a50a04925a1cb79d906f6c9c5d7f5ab0a44

  • SSDEEP

    98304:ue/3MuoyjkyI6hZmaRWY42mJAt9hRp5sRjoisTbsmiV2v5OpXi:RvbDjdI6nRWYx2joiri

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://asik37df.xyz

http://va8fjvz.xyz

http://kav9kva1.xyz

http://puti66bv.xyz

http://brev8sv0.xyz

http://uy27dhzca.xyz
DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.ysrpmcmmi.rxhnapfhh
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4260
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ysrpmcmmi.rxhnapfhh/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ysrpmcmmi.rxhnapfhh/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ysrpmcmmi.rxhnapfhh/app_dex/classes.dex
    Filesize

    2.0MB

    MD5

    456b247c526a9eaf44675ccb8d5e06a4

    SHA1

    fd36e58c78391a2104bb44fab24a0e7efb73df3d

    SHA256

    fe86bdd0f9a6a6fd9dc81e9be0237b2221a6d1859d59499f2e9734c6a6e2b81f

    SHA512

    c1417ce12e01bc8ea1aef1fadc0c752ecf0310f88bc02b3bfc21a2ec8387bb82a691e4997fe27fe676a66aaf5eaed717d36a171cf9f8893356f81fcfb9070982

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/cache/classes.dex
    Filesize

    985KB

    MD5

    2a7260a9ef081de8543bfdea2ddfdbd7

    SHA1

    a50446f83c72a6c38a5c3472950db2a7ffe07bf0

    SHA256

    68304dd948c833abfda7ccc70e5c198f6a90ac43ac0430fa7792721489df45c6

    SHA512

    02ff4b6b4a76bd3486a89d2898a0fb6b9f74d681f3c394bc4df4ae208e72a670628050c5666608a245d3ef52efc7d19cce182c32e37f7fd1b9718ca8ca14f5f3

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/cache/classes.zip
    Filesize

    986KB

    MD5

    724cd5d0316eb515cdd8a007ddc1b982

    SHA1

    ebeaebfef153bbca116f36a767d02175a463eeec

    SHA256

    aa6eefd8de41787c68d5f3b1c40adc473793e39275081e54d9f2de87aa381283

    SHA512

    eb92d125776164ed20db655ffeba2f863a9e30101837d47e18c8c51185d628bc346e9ec99139d1cd543a89bbf4d9ec46db6f47fe320bdecb0ab4eb3f0d690363

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    6be56ba6735abf0ba96ab0ad1d6f4218

    SHA1

    c20b9a816a358c34fe8df996de0f2dff8f54b996

    SHA256

    56adbc24a2085e87039afb1780e4eea070937efa77cca2a19b0a7b76ca7e387f

    SHA512

    733e734d34ced9b2dffffddba426648206d1705d6d1c741ce51f12e1c8ba937b5c98cf3e08ecbce6538c0ee0c0d64656585bf90827de95dfbb30a0bd330d1897

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    74400e4314e768ddd069e832dc171713

    SHA1

    4ce7abd878764fd7c4a6b890cb61f342a242ea9d

    SHA256

    372070aa59d0479b1dab838c4459ad0df0e7f5f0f6478c5f7cdbf7e3beb0ee76

    SHA512

    d47fbad42c897ed787599b27a2f29e774e7b0ac67007d334a04d4c8e7a59e6595aff19e30030882395d9dde7683bcd9c363c83986340f62f4849fc8ffc2960bf

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    9ebefd7d4f2d0faedaeb3a32248ba3d6

    SHA1

    540e1e28f800f1953d15814a5950789c81820921

    SHA256

    ecd5259d69da6d5d1d94b10c956df01b91bb8a124f0a5becff9eecb32d674957

    SHA512

    d5a1e4d5947efa7682e6d9ddca00d1e9116a5c58063de27f83907bfd164b5b19402b2abe937e2fc1107b3b28e99b55abbf44031eecafd161f8c439a39ee137ec

    Download Submit

  • /data/data/com.ysrpmcmmi.rxhnapfhh/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    3927cfbea28ae1a9900608ebb3c2526c

    SHA1

    330e852fdc7cec49998b3519feac0c1e11156836

    SHA256

    8797b480a4a542099375563faaafdae52946603818cce7867f52e95bc87c0bdd

    SHA512

    6907be9ef9e751c6380aa236c18f059fbc811a50717af51686620140e69fd6d2b7b1cc3db1b9205a5b8e567d1f3052af62a3d53d27fcb1261494e39fbfab85fc

    Download Submit

  • /data/user/0/com.ysrpmcmmi.rxhnapfhh/app_dex/classes.dex
    Filesize

    2.0MB

    MD5

    33b7b0c06ed12c8097fba771ee516131

    SHA1

    dc22be90f0d033f9abb8d2fdc79a6285189a10cf

    SHA256

    ec5e44b58d71229ab440b20d24091de0f8c164f924b6ae95aafb1847a38d3162

    SHA512

    33020caffacdfc7759d7a5c24fac0e8d0bbe692e76008d898c058b63cf9d7ccc5d17f3c587b7047df29f2dfe05279a7168499f99202d7c895d3abb77ef82e90f

    Download Submit