hook | c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02-11-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622.apk
Size

3.3MB
MD5

6e886c71b9663012f6659f347790c979
SHA1

a072280867503e885a530663925b769513305f8c
SHA256

c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622
SHA512

66d82c1d1a44811af173c3894adf8ce80ca28448e82ceed70b259ec19237ec563a71e6bf03d3fd0a3ee058bf1e075bc24455ed1cd3da8e213ff8883052264563
SSDEEP

49152:eccV5SLQ0vGHNaSWrqLZXQ4wayCeqj/f7OBWRwMCWQG9i+nrfoEsnuI4nviujngg:WNvreqrqBDWvTrf3snudbjnUO5X

Score

10^/10

hook collection credential_access discovery evasion execution infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://5.42.199.22:3434

Extracted

Family

hook

http://5.42.199.22:3434

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/x86/FPR.odex --compiler-filter=quicken --class-loader-context=&com.lojibiwawajinu.guna

ioc	pid	process
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json	4281	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/x86/FPR.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json	4254	com.lojibiwawajinu.guna

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lojibiwawajinu.guna
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lojibiwawajinu.guna
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lojibiwawajinu.guna

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.lojibiwawajinu.guna
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.lojibiwawajinu.guna
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.lojibiwawajinu.guna

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.lojibiwawajinu.guna

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.lojibiwawajinu.guna
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.lojibiwawajinu.guna

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.lojibiwawajinu.guna
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.lojibiwawajinu.guna
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.lojibiwawajinu.guna
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lojibiwawajinu.guna

description ioc process

File opened for read /proc/cpuinfo com.lojibiwawajinu.guna
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lojibiwawajinu.guna

description ioc process

File opened for read /proc/meminfo com.lojibiwawajinu.guna

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.lojibiwawajinu.guna

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.lojibiwawajinu.guna

description	ioc	process
File opened for read	/proc/cpuinfo	com.lojibiwawajinu.guna

description	ioc	process
File opened for read	/proc/meminfo	com.lojibiwawajinu.guna

com.lojibiwawajinu.guna
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4254
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/x86/FPR.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4281

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
701KB

MD5
b09697967fc3f037886fac9ad5fd1606

SHA1
52859516f1d0fa838f0a242e06313c246e2f8fe6

SHA256
8e9c3340379daca8c48bbf0af964620b0d57a1bceeef1dd0c8d5579c62580d7b

SHA512
c1dcdec5ed71e335ab4979e5620d63d67ed242f2d72f7c016608c270035452dab92fff7e40e7726313aab7f803c6de50a3e79b738518bded630d52cb1dc5110d

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
701KB

MD5
a2b0e46bf659022501f9a1f954ee5128

SHA1
8f4c0964a75b21f99e9ada22f3190be553d8856e

SHA256
48c24081b941babc5b2a5ee9d0dc8d99ca4efc0d9eea5c7752b74d73e000bb49

SHA512
4573762436c3bf14bd2f035f94f00097522cfa2bb3dd404fcdc58e5fe4aa37ff7180c1af9cde0268a47f06bcd83b4916578ef6a4464b242e9b79036b5537c455

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/FPR.json.cur.prof

Filesize
2KB

MD5
1f37ff40e2e0a404b19f32297a26561a

SHA1
bae420c73fcfb0d906af3a53e0f2a1bbade1f90b

SHA256
c46d5f13059df59c3fa9ad0207758d04dbed238174f36ce5c64c46348a819224

SHA512
2c71246c7afd419bb97b5e621f7bba9b2ec9668f6af75e22931d91192d65446534aa75c92028cfd8ee1e0518913cee5d4e2c076bd99ac741ed562e9cd1859133

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/FPR.json.cur.prof

Filesize
2KB

MD5
b750de35246bb801818632d74460c0b4

SHA1
28e00c7aa59d9e44c05248a9fcd0ed104e19f48b

SHA256
a678a63dfb28a1b0f94856fe404e6f9b81396b3a533c36a66d7480d05ed8d96e

SHA512
be3d967947f6b951f9555a41a72092ce51549d99dfb1ead1e87ea32df53f2867965ae6783b39571415f2895c55ef428b357bfb1e53d3cccb206862424225c2fc

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/FPR.json.cur.prof

Filesize
3KB

MD5
78bb5fc5edbf52a945108d20ca495406

SHA1
9baa133779adbb9b74227051a4af34e9126da0d1

SHA256
796d3fcbf9b76a8a7205bc7aec6c22bf6503da4fa157f1447544f83e3d92049f

SHA512
19faf6e48aa71fc754653d7ba6f0aec8313d3ceaa5017467fffb09b4f46999d2d965484e2ed4ca0d90ab43f9290930beef2239851186fbe69263e59c73bdce66

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8f3a4b90947dd34e053c27226f3db38d

SHA1
8220a24f137f603813182a60da8de05cb96660c2

SHA256
73ff9aefcef6e48a3a20401359e4233b585d9e4f24a5af1631aecb061fd26295

SHA512
f5e8055411ce90d9229de241f521bea7405ac27d1ef3437fbb6158a89909c7fc4a2dc65e6d0924c8c5d6c97c63482e9c4b3cadfd9f3295c60b6e0886119078ac

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
2171109980efce2bc291045fb321fc41

SHA1
3e7ca763cf0a59152356dac43052ada969723b41

SHA256
f8bdfecfc1409d0f6b2a5478e9650d4d30428d8da7dd93f3ae2ce377a579f946

SHA512
74642d702c693c835c516edb2e453ac42814fa27b2327d33e3f7092c103b19ac193fb8eb3dadcd181bec96e9925f23c17ac290d191c0afeb7a87ae413258cc47

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
6910408b3d1d4756a0b20cf0f7ead9a0

SHA1
c4850d1e83388ea0c26da2807d86da7ee47b1a18

SHA256
30458b5815e1cd9bb10852ce79fb4d0a78544c38cbb65c16f9f6c191840bc778

SHA512
43cccc01426b25b01b8f3f0046f9709bbb297c3347a2db77e635437fec1d34ed0af80de427a34aa1380803c660c4f8558109337773a0325bf2b6a4270fac2c33

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0e4318af68c64a5fbde1b9b11791ba6e

SHA1
386236a4a07d36ad93667a7977fe5ae67083a862

SHA256
318d5c793dade69f5dd0c0a99ea697f260f1357ef63514a0ed2633a26157254d

SHA512
54b385fe81d94877fdbd7f31c4e2baf3e7e27735c6f44ad635ea2f5ae57dda02da9d5d344410ee9ba19342e69deb3362676f865f8ae00ff30751d06c571e8ba9

Download Submit
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
1.5MB

MD5
4a724f78ef71e36feab7d14b5ca0ba7c

SHA1
ce2dfa92b444434cd4d14a19365c6b4c968bfb00

SHA256
409d233c6ad384757cb49a9c56d54215c82a4f4847038a22dd32df2a0bf3eec6

SHA512
60dabeb3b91dc97df1ef72d3961158baa4f2f802b26eea2ca876b849d00efb4b3e329f7b99afb6787ffdab06ed24991b67b7f87cc55c0fa5d137aef8970a0b2c

Download Submit
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
1.5MB

MD5
b5587652ce75a9b88bcb7e9dd4be3d18

SHA1
32fcdcb0aa31624a74af84883af251e9ed4b066a

SHA256
c689ff3fb9e94b365a2a954a3bbab4a91506dfca2801d36b74d678b21d798d36

SHA512
37ab41e6f7995451ec317821327772cb1fce0d95abb1a5eed6317e4da74b3c2e8db781ffff0ee018359db0d7b19718f58784d2f5d9381a47638404527bb25dad

Download Submit