hook | f40502a1e9cb93bf9cf23846b2c9cb3e9a2540f21e83fd02cb840e313fedd72d

Analysis

max time kernel
149s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
20-10-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f40502a1e9cb93bf9cf23846b2c9cb3e9a2540f21e83fd02cb840e313fedd72d.apk
Size

4.1MB
MD5

fa4fd4b43b42da37c95c290c3f757f57
SHA1

7905e516756c128a2ed313b4a1d4ccc845c2ab1e
SHA256

f40502a1e9cb93bf9cf23846b2c9cb3e9a2540f21e83fd02cb840e313fedd72d
SHA512

db0bfeea36e48888f1f2962dffeffc747a7f239bb553e89d02513eb50a10cb67246b072fbd67592ae093fd82af97f99f06ab493fec7aad7cac7b67e7158ac104
SSDEEP

98304:3sFKzyEzqTAOHrqVpTShOnLqcX8PLHH6C6:8/dxLqbTznLMGC6

Score

10^/10

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://tFJ1Yc1F.live

http://ghXYum2i.pro

http://h3J4TxZu.pro

http://XmMqg4gZ.live

http://q5drCM5Z.pro

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.zrxngqosx.finexkunc/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zrxngqosx.finexkunc/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex	4270	com.zrxngqosx.finexkunc
/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex	4295	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zrxngqosx.finexkunc/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex	4270	com.zrxngqosx.finexkunc

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.zrxngqosx.finexkunc

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zrxngqosx.finexkunc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zrxngqosx.finexkunc
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zrxngqosx.finexkunc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.zrxngqosx.finexkunc

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.zrxngqosx.finexkunc
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 api.ipify.org
9 api.ipify.org
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.zrxngqosx.finexkunc

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.zrxngqosx.finexkunc

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zrxngqosx.finexkunc

flow	ioc
7	api.ipify.org
9	api.ipify.org

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.zrxngqosx.finexkunc

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.zrxngqosx.finexkunc

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.zrxngqosx.finexkunc
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.zrxngqosx.finexkunc
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.zrxngqosx.finexkunc
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.zrxngqosx.finexkunc
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.zrxngqosx.finexkunc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.zrxngqosx.finexkunc

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.zrxngqosx.finexkunc
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.zrxngqosx.finexkunc

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.zrxngqosx.finexkunc
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.zrxngqosx.finexkunc

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.zrxngqosx.finexkunc
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.zrxngqosx.finexkunc

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.zrxngqosx.finexkunc
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.zrxngqosx.finexkunc

description ioc process

File opened for read /proc/cpuinfo com.zrxngqosx.finexkunc
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.zrxngqosx.finexkunc

description ioc process

File opened for read /proc/meminfo com.zrxngqosx.finexkunc

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zrxngqosx.finexkunc

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.zrxngqosx.finexkunc

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.zrxngqosx.finexkunc

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.zrxngqosx.finexkunc

description	ioc	process
File opened for read	/proc/cpuinfo	com.zrxngqosx.finexkunc

description	ioc	process
File opened for read	/proc/meminfo	com.zrxngqosx.finexkunc

com.zrxngqosx.finexkunc
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4270
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zrxngqosx.finexkunc/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4295

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zrxngqosx.finexkunc/app_dex/classes.dex

Filesize
2.1MB

MD5
2fdb86048ffbe6b0a3096e04da2207ca

SHA1
f1ab3d9dc2bb903398cb8c83e69ec3292acf8994

SHA256
be5cb69ba481bfb1cc29f25d9dd6a5ee0294778d360891b79ac572ee74a38b4b

SHA512
f57d9cfe5cb4876b7c51040fb7396eedcef7a94b9db68890d1a9c4df59cb69ef2efaa602789911b132e30dddd5e9b878d2f9ea3a6fb633a24da9b7708e5f1ec8

Download Submit
/data/data/com.zrxngqosx.finexkunc/cache/classes.dex

Filesize
1001KB

MD5
04ebb3e544ef989234a5070b77dc15c7

SHA1
e7f69f2d5596656a5db28ae02c6fac785df67821

SHA256
5301f2c7cd5e21fe52d23e8834ac2573cd85ed9d862fb6579117bad2e6c02ff8

SHA512
ad656c65938dc898963889d5f35cd3a1dc16e0034336e060d7d6a5b66f5ac986418aa02f5ff6f7abd8319c87292e0dc41a48155858ec1fac8ca1b4de4899f49b

Download Submit
/data/data/com.zrxngqosx.finexkunc/cache/classes.zip

Filesize
1002KB

MD5
43d37af0afb866deacf873550468c712

SHA1
af3c1e1c59587efbaeecf4b68d91a132db95ee1a

SHA256
ab9cf14fec3b9608db617cd026df1ea400b87dac0600f607d389d08c3ddcf712

SHA512
0a51f5509b07d83e4dea65374b8a100c62823811459ffd05617984db5ff707517cccb275a374e51929682881e1b37c3c2beb440dd33312233c26d7741f545781

Download Submit
/data/data/com.zrxngqosx.finexkunc/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.zrxngqosx.finexkunc/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
342ddd00a96f16373ecc38d482b19648

SHA1
220bd5b279d76a5c2b7ac777c23b235354fec0d0

SHA256
1592785c5e4841dd9d9c2966ecac5b8567ccd321d807d0c5558138b632faf122

SHA512
821d19ff6701ee98885cbfbc25111022cfd9ff4356ecb5426af22b9aa8fb4a717e7d261ce225b5efddb8a068e50a7c34098194a022be22be6adb213325bffa82

Download Submit
/data/data/com.zrxngqosx.finexkunc/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.zrxngqosx.finexkunc/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
3a4e0660558d8c9b0f63261efd1a106c

SHA1
67b1a2547a04c36311b7fe8ee53bfa5f76c14044

SHA256
4b29559bdb25d1a8ebf3e862ada51060c9ed73b7832ea40ad82dcc14e193b688

SHA512
17c37f586cea9deba7a7ee9733e9276e0c30adab1fe1c59acac6d59e20040fabc9489c42d777ea7dbf22991594d22622da3db598c45b0a5373fab708f4fdd3d1

Download Submit
/data/data/com.zrxngqosx.finexkunc/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
93537497769f7cbb4a609c8aad3a8d35

SHA1
0e426e27ea632f62f03f30f03ca9ca823f2dd0c0

SHA256
11ea68b9cb9b99e52cba97b4b04f3cda09f88465f742b3ea210df7db39324459

SHA512
74cd38ce83137966a206cceb3bf4f79d642f2a73b164fa78caf47b7f8b30299f9bc759f8dd1f94db8e30c27ecb1c897958e56d0d66e632f08b5117825ecdd0b3

Download Submit
/data/data/com.zrxngqosx.finexkunc/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d6f6aa8ab94041589b875ed308a2aff8

SHA1
964acb78627893b5076e6cb26f46746f32e7f3b6

SHA256
af3f616097f267f3b3678e1b5e04ee713bcff9d65033910ebf6f8f70437ae11e

SHA512
d7cd16ffe02f4c6d62f1f130b792778eacfc725a1274283a6905ecbbc76fd2d2e04945b8076b6400584d8ef36e7d2f7224faa8a84009d59eefac08dc99a41f70

Download Submit
/data/user/0/com.zrxngqosx.finexkunc/app_dex/classes.dex

Filesize
2.1MB

MD5
e4af3ffd46664ea01305af17b9dcb20f

SHA1
3831f97543c283ebbe3e699205968ef8c66290f8

SHA256
f3573eb351b518797e05e21a8d48bb6c72d3b7c393a54e2b5a7ff5eab1ab3b46

SHA512
cb6dfb8e9925cbbaff70789130b1dcda9512fe719fcaed4861ea6e533b590d567febfbb6594f8f31ea3e6e4e9f85ccff200d99f10bf2e7d853b7b5e80b0aee15

Download Submit