hook | 699d589e1470d40cc02a1880dab4a4cac24f681096b200d4871fe3c6807337ce

Analysis

max time kernel
149s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22-10-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

699d589e1470d40cc02a1880dab4a4cac24f681096b200d4871fe3c6807337ce.apk
Size

3.8MB
MD5

a8ac839b76d0fbae5c83fedc18a0fc46
SHA1

75ab8369c36851f6bbb15e47581d96d9192e2488
SHA256

699d589e1470d40cc02a1880dab4a4cac24f681096b200d4871fe3c6807337ce
SHA512

0b62f778ad02a92fc9007ef1552432ebdd2510f99eb4852d1e31c69c29877a3fc943f1918b0338fe03df609f91dd9c3569ae21b787d6034c28f62ea618983606
SSDEEP

98304:0V+Spd1dyQhQEsnumInt8oHHgYMbIXbnsVHrFe7:/SpdSQh+/cDiijaw7

Score

10^/10

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://negroti5k3fa.info

http://aprilka21jfa.live

http://mishao11jfac.pro

http://vamir99ffkkd.info

http://prebadejf41vv.live

http://hopfvba01fv2.pro

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.fswdooiiy.cmmlmkjde

ioc	pid	process
/data/user/0/com.fswdooiiy.cmmlmkjde/app_dex/classes.dex	4761	com.fswdooiiy.cmmlmkjde
/data/user/0/com.fswdooiiy.cmmlmkjde/app_dex/classes.dex	4761	com.fswdooiiy.cmmlmkjde

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.fswdooiiy.cmmlmkjde

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.fswdooiiy.cmmlmkjde
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.fswdooiiy.cmmlmkjde
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.fswdooiiy.cmmlmkjde

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.fswdooiiy.cmmlmkjde
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.fswdooiiy.cmmlmkjde
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 api.ipify.org
24 api.ipify.org
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.fswdooiiy.cmmlmkjde

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fswdooiiy.cmmlmkjde

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.fswdooiiy.cmmlmkjde

flow	ioc
22	api.ipify.org
24	api.ipify.org

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.fswdooiiy.cmmlmkjde

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.fswdooiiy.cmmlmkjde

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fswdooiiy.cmmlmkjde
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fswdooiiy.cmmlmkjde
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fswdooiiy.cmmlmkjde
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fswdooiiy.cmmlmkjde
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.fswdooiiy.cmmlmkjde

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.fswdooiiy.cmmlmkjde
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.fswdooiiy.cmmlmkjde
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.fswdooiiy.cmmlmkjde
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

File opened for read /proc/cpuinfo com.fswdooiiy.cmmlmkjde
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.fswdooiiy.cmmlmkjde

description ioc process

File opened for read /proc/meminfo com.fswdooiiy.cmmlmkjde

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fswdooiiy.cmmlmkjde

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.fswdooiiy.cmmlmkjde

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.fswdooiiy.cmmlmkjde

description	ioc	process
File opened for read	/proc/cpuinfo	com.fswdooiiy.cmmlmkjde

description	ioc	process
File opened for read	/proc/meminfo	com.fswdooiiy.cmmlmkjde

com.fswdooiiy.cmmlmkjde
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4761

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fswdooiiy.cmmlmkjde/app_dex/classes.dex

Filesize
2.1MB

MD5
bfec9b0c3f2bba39d0084e56786f7578

SHA1
1caa527bab6520858df835250f0793285828ef06

SHA256
c3937c8231f0fc95c1650753d9d4bbda0cdb117bbd5ed76d70b029d06efa7542

SHA512
156e9c71a4540a722cefd65bcef0aa4a94071addad650e6dfca5cca8147eba79d59178263f7f3a9f27865fd53b7949b04a8c7ac7a556d53478753a942f642aec

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/cache/classes.dex

Filesize
1001KB

MD5
f09b81a97759ae30633f34306a74e70b

SHA1
41750c4a083633234414b618df68f4dd9812993f

SHA256
01cbb7e5194b3e759cd4e12905f53e02d9f069cae83225877fa008d4ad9a42bf

SHA512
676b5be3a34ff76c538ee9427aa1ad77520fb90956b61e6f07f6b753aaa583bfdae1afe942b5569e07ed37ff2ba33f0c368fae3a7d38926a97e15a4af8cb1df4

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/cache/classes.zip

Filesize
1001KB

MD5
ab4ff79224a3356923bdf52a28b9366c

SHA1
72992ef16e44f4949c685e5ca6bd645d152d6da0

SHA256
38c4affa1998922818f3500b772c5a6f9c1b0966745ab90da036507a32fd8399

SHA512
1ebc21bd8f814e720700dc16ba4a9070a6506bf1fd74d854da8006d465611e4034bb3a1b38204fcea34fd8c1151505f6af09cc0a54fca91c274a6e54cfabd605

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
01050a01fdf6d5a964fc2a61c72980ad

SHA1
03da004cce8919f768cf34013e1a83f3283dbcdd

SHA256
296503d8666dae3933d8f386dbde3b9f32114db6133f28c393750d375b91ce19

SHA512
bd82638ba2d5aa5f9f473deb63d9c8f788544d73275d3eae167e4ea555ecebffc68ae75ee058c0a428ad0deee372970128203b745f1492ca8f8fcbab7223e7a1

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
498c7edfef947c3fa13dac6725707b33

SHA1
ba89915ff1f8ff4a9b2ee46df3aeb31184c1eaed

SHA256
439ff0b4409fda5e0a118608995a906285b4a24ccf735a13794d4393c90c4e10

SHA512
2472ee2ef2e4e1794ba6aed0124620b46819b176b3a1a278c3c9d0348e0c715ff3cc6b110d4dc904865f54ab055998559e04bcc489090fe3ebc6a904d2c720e8

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
d7c0b195dea0b90bc9d89ff8f89a145d

SHA1
39e9e7d13bb34c50809f1b9fa3685b33eeb13764

SHA256
b8813ace63fb765ff6eb90250e82e4a996c2746e3379aae1b412bf912a9e9176

SHA512
9f6d4d5d6a9a844a45516446526fce53f70916cf1f0a61141ab20fa3bc04165c2246307bbc72badd37526f9420a1741dfc471a5e5327f3201b9030a5c6fd2cf1

Download Submit
/data/data/com.fswdooiiy.cmmlmkjde/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
425b9b0bfc8c38a72dccf5739c8fce3a

SHA1
3d8e7a9d6d82bb6b20b3a217ad2bdd8342bd57f1

SHA256
6891eb6a855e153d8e4864686e92cd37917729b88871ba30b4df05386e68eae2

SHA512
a60a0e0393a3edad2f477002d1a540366e7b2a4535890c4bc99bb9c16709c201dd812e0f71b4e234c798d15499dac60bc66b985a930efe3161f51d8f0f9a9aec

Download Submit