hook | c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622

Analysis

max time kernel
148s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
02-11-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622.apk
Size

3.3MB
MD5

6e886c71b9663012f6659f347790c979
SHA1

a072280867503e885a530663925b769513305f8c
SHA256

c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622
SHA512

66d82c1d1a44811af173c3894adf8ce80ca28448e82ceed70b259ec19237ec563a71e6bf03d3fd0a3ee058bf1e075bc24455ed1cd3da8e213ff8883052264563
SSDEEP

49152:eccV5SLQ0vGHNaSWrqLZXQ4wayCeqj/f7OBWRwMCWQG9i+nrfoEsnuI4nviujngg:WNvreqrqBDWvTrf3snudbjnUO5X

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://5.42.199.22:3434

Extracted

Family

hook

http://5.42.199.22:3434

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.lojibiwawajinu.guna

ioc pid process

/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json 4982 com.lojibiwawajinu.guna

ioc	pid	process
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json	4982	com.lojibiwawajinu.guna

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lojibiwawajinu.guna
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lojibiwawajinu.guna
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lojibiwawajinu.guna

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.lojibiwawajinu.guna
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.lojibiwawajinu.guna
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.lojibiwawajinu.guna
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.lojibiwawajinu.guna

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.lojibiwawajinu.guna

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.lojibiwawajinu.guna
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.lojibiwawajinu.guna
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.lojibiwawajinu.guna
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lojibiwawajinu.guna

description ioc process

File opened for read /proc/cpuinfo com.lojibiwawajinu.guna
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lojibiwawajinu.guna

description ioc process

File opened for read /proc/meminfo com.lojibiwawajinu.guna

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.lojibiwawajinu.guna

description	ioc	process
File opened for read	/proc/cpuinfo	com.lojibiwawajinu.guna

description	ioc	process
File opened for read	/proc/meminfo	com.lojibiwawajinu.guna

com.lojibiwawajinu.guna
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4982

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
701KB

MD5
b09697967fc3f037886fac9ad5fd1606

SHA1
52859516f1d0fa838f0a242e06313c246e2f8fe6

SHA256
8e9c3340379daca8c48bbf0af964620b0d57a1bceeef1dd0c8d5579c62580d7b

SHA512
c1dcdec5ed71e335ab4979e5620d63d67ed242f2d72f7c016608c270035452dab92fff7e40e7726313aab7f803c6de50a3e79b738518bded630d52cb1dc5110d

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
701KB

MD5
a2b0e46bf659022501f9a1f954ee5128

SHA1
8f4c0964a75b21f99e9ada22f3190be553d8856e

SHA256
48c24081b941babc5b2a5ee9d0dc8d99ca4efc0d9eea5c7752b74d73e000bb49

SHA512
4573762436c3bf14bd2f035f94f00097522cfa2bb3dd404fcdc58e5fe4aa37ff7180c1af9cde0268a47f06bcd83b4916578ef6a4464b242e9b79036b5537c455

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/FPR.json.cur.prof

Filesize
3KB

MD5
16360e160c23080932aa29a5b519e621

SHA1
969414a85f44c10b6b46517a5fc04fd6cefb141c

SHA256
fc31a5e1e7c4c0af65b96e1bd161e1365131c8c331c9438c465748675234c39b

SHA512
f80f261127ea0f1c250ddc55f6c61f5683611a193884e4f96936018662ecc6e0900a8acff52415c17786516e7ce0bf8098464e96300ba132d74421b24d665701

Download Submit
/data/data/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/FPR.json.cur.prof

Filesize
3KB

MD5
53668b2d5ce7eeb0a3b73b2ef599d4c0

SHA1
e833994f9afeadd37857552ab491c013a2396c20

SHA256
84c7df2114d3d04710e9d508718dabe6290f48a0c48b61dff853f02668907054

SHA512
e19e6830cf2e6a9e9d07df051eb5346a9d90fb9324b5a9188d49d1344b715987b31de7026a6f608c3bde6b220f0fe3d3c20923d074e0d330b261f89c25494580

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5b0966548e8c03071c8ebe7d00495ace

SHA1
ffe5bd895946c348bf171c123ff01f92e86bd028

SHA256
2d95c11f2fc7f08e290f6fe2d1782c0c165afb6fadaa2d06369cb9571eb769f6

SHA512
fd2714d6d9ea18c6fbb3617f09f1ead180da8e9efe63cb8741757cb6747e83666747dacfda1755f02f93bd6bec962586740a4259b8053447824e16635bfb13ce

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
570064ab209951d632cf6682e6de3bc7

SHA1
6899e9220708259208a233bc4073480b3c69d0c1

SHA256
c1ac3f23125ab782577548e79786894eef67e56f5e727b40d91e3bfd870d611c

SHA512
57ff28a5cdcf180a466475a6ae17588c22f46e2df6ea895fa17db19dfa511862494db016bef8e1fd7593a2400c317410957477c414d532a4629cd84485ba5a56

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
94b2e612d6a53544ccc600ce02e5a585

SHA1
694b7e09024565f18d1c350e0f898c6dd52ff7bc

SHA256
842436bd5e805fd9f4c29250c1b4282e58991aecd1757c4210787101742174e0

SHA512
700c84263facfddbd3ac5a2229a43f8ebf1af506a397edf2de5ad14a53f7835e058c8ec14bb5998626e5a910dc901a37b928ca72289fd1de552c0c9f40bd8e73

Download Submit
/data/data/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d067ec416fb9b7c9016128785f453f2d

SHA1
0ec0787e33f45ee93de0ad866629e3f79cf0df71

SHA256
e7aad3114bb2185e5e23d60bc35848facdcf7b50d7f9c20f2e7b7f349c0dd7e9

SHA512
67948c08c21f0074a805c5661822cc4cb522183581869b9ce02c20f607e76bae9c2051e3fc5589c9bfcaba5ae8c5b3a3f37b303274383d5b0730b91e60701bd9

Download Submit
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
1.5MB

MD5
b5587652ce75a9b88bcb7e9dd4be3d18

SHA1
32fcdcb0aa31624a74af84883af251e9ed4b066a

SHA256
c689ff3fb9e94b365a2a954a3bbab4a91506dfca2801d36b74d678b21d798d36

SHA512
37ab41e6f7995451ec317821327772cb1fce0d95abb1a5eed6317e4da74b3c2e8db781ffff0ee018359db0d7b19718f58784d2f5d9381a47638404527bb25dad

Download Submit