hook | c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622

Analysis

max time kernel
149s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
02-11-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622.apk
Size

3.3MB
MD5

6e886c71b9663012f6659f347790c979
SHA1

a072280867503e885a530663925b769513305f8c
SHA256

c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622
SHA512

66d82c1d1a44811af173c3894adf8ce80ca28448e82ceed70b259ec19237ec563a71e6bf03d3fd0a3ee058bf1e075bc24455ed1cd3da8e213ff8883052264563
SSDEEP

49152:eccV5SLQ0vGHNaSWrqLZXQ4wayCeqj/f7OBWRwMCWQG9i+nrfoEsnuI4nviujngg:WNvreqrqBDWvTrf3snudbjnUO5X

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://5.42.199.22:3434

Extracted

Family

hook

http://5.42.199.22:3434

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.lojibiwawajinu.guna

ioc pid process

/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json 4610 com.lojibiwawajinu.guna

ioc	pid	process
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json	4610	com.lojibiwawajinu.guna

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lojibiwawajinu.guna
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lojibiwawajinu.guna
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lojibiwawajinu.guna

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.lojibiwawajinu.guna
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.lojibiwawajinu.guna
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Acquires the wake lock 1 IoCs

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.lojibiwawajinu.guna
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.lojibiwawajinu.guna

Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

Processes:

com.lojibiwawajinu.guna

ioc	process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.lojibiwawajinu.guna

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.lojibiwawajinu.guna

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.lojibiwawajinu.guna
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.lojibiwawajinu.guna

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.lojibiwawajinu.guna
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lojibiwawajinu.guna

description ioc process

File opened for read /proc/cpuinfo com.lojibiwawajinu.guna
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lojibiwawajinu.guna

description ioc process

File opened for read /proc/meminfo com.lojibiwawajinu.guna

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lojibiwawajinu.guna

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.lojibiwawajinu.guna

description	ioc	process
File opened for read	/proc/cpuinfo	com.lojibiwawajinu.guna

description	ioc	process
File opened for read	/proc/meminfo	com.lojibiwawajinu.guna

com.lojibiwawajinu.guna
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4610

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
701KB

MD5
b09697967fc3f037886fac9ad5fd1606

SHA1
52859516f1d0fa838f0a242e06313c246e2f8fe6

SHA256
8e9c3340379daca8c48bbf0af964620b0d57a1bceeef1dd0c8d5579c62580d7b

SHA512
c1dcdec5ed71e335ab4979e5620d63d67ed242f2d72f7c016608c270035452dab92fff7e40e7726313aab7f803c6de50a3e79b738518bded630d52cb1dc5110d

Download Submit
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
701KB

MD5
a2b0e46bf659022501f9a1f954ee5128

SHA1
8f4c0964a75b21f99e9ada22f3190be553d8856e

SHA256
48c24081b941babc5b2a5ee9d0dc8d99ca4efc0d9eea5c7752b74d73e000bb49

SHA512
4573762436c3bf14bd2f035f94f00097522cfa2bb3dd404fcdc58e5fe4aa37ff7180c1af9cde0268a47f06bcd83b4916578ef6a4464b242e9b79036b5537c455

Download Submit
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/FPR.json

Filesize
1.5MB

MD5
b5587652ce75a9b88bcb7e9dd4be3d18

SHA1
32fcdcb0aa31624a74af84883af251e9ed4b066a

SHA256
c689ff3fb9e94b365a2a954a3bbab4a91506dfca2801d36b74d678b21d798d36

SHA512
37ab41e6f7995451ec317821327772cb1fce0d95abb1a5eed6317e4da74b3c2e8db781ffff0ee018359db0d7b19718f58784d2f5d9381a47638404527bb25dad

Download Submit
/data/user/0/com.lojibiwawajinu.guna/app_DynamicOptDex/oat/FPR.json.cur.prof

Filesize
3KB

MD5
9ac0c9765f1371ed2ee787fdff73f267

SHA1
22461e49d70ceab57a56edbeec5bf69759ddd162

SHA256
6d39cef0100033303af0661f70f1c1ebe93230a9c8ca7eb5ea91d7908cc79277

SHA512
b965d13a0b77184cf7f771a987f5c13a6430d07a06d61e465febeb916aa3f0ac0a2d1a0b23077b854c50973907aab63a434c21100372ae1253957ccdbb5174ea

Download Submit
/data/user/0/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
84804ddb25e5a4b0b1a63224c89f76d0

SHA1
299fb39337807fa2ec393c36a167c7257abf7c58

SHA256
a0f3a7d60c44a9fe0c433da375cb524e17d1094d013f58cf314c273cfd76aa48

SHA512
a16631bd840e9248554e9b645623a7a69306b3d9749194ac5c5e935bd941b2661c287d3979a79cbe3b66c3f2d9e6cbe8decfdcb2e202ce52dca1b301ebc46334

Download Submit
/data/user/0/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d38deab6eb5245b1953896d711baef0a

SHA1
552d58ceb5b5cce7af91128072701fb4f2a43b73

SHA256
08666c1b109eaf8d97439c8079961d87f4afbfb300fd5eb6f3277e123eec6349

SHA512
f86181b418e21f02d3e29c67da96ed09beb8045a55e1cb07a1a08ec83d2ab2800e1c1666baddaeecad4f9af6fe7a92c93db4ddad7603d0ee5da9c3cb35ae5f40

Download Submit
/data/user/0/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
4737be24195c701a1eb7fe2f63749e17

SHA1
17088baaea99418729530741ae4699afdc2a0d82

SHA256
09128a8f6179e1f3cb2a1cd3ff0f4befc03f7b899f03e8f042801ca825e8e4df

SHA512
37c567f366eca8d3c1f1162f634ffae8b6722024163184b23aa09b657f09f253be45b7e84c468534bd288a75218742ab006d9dcc7c194592e105b01aff0b2d18

Download Submit
/data/user/0/com.lojibiwawajinu.guna/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
e4b8273a4eb33bbba30fa005ac596d11

SHA1
9984baae3a34d42f2adfe0d0195a0ea840e6c3f5

SHA256
94fe7fb574078a2f42afac11ffceb7a07d5f00860dd334f1ea9b73595591830b

SHA512
c31b38e0caf78c543f3f9eb7977820b14f82065c1361a771804dab5d95bc839d7e002c3afc375e4c128923b8d8508f333e41184a53ae1e8a03c0649ba550d7c4

Download Submit