Overview

overview

10

Static

static

6

35dc83b868...ac.apk

android-9-x86

10

35dc83b868...ac.apk

android-10-x64

10

35dc83b868...ac.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    11/11/2024, 22:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    35dc83b868ede705f2095db3bb162d07d452fb54b34881613e2eeda988a175ac.apk

  • Size

    4.2MB

  • MD5

    d747554f5c988cfd287aa604e9522557

  • SHA1

    9f7db7025e897288e1b50951ba0a94afb4ebac5a

  • SHA256

    35dc83b868ede705f2095db3bb162d07d452fb54b34881613e2eeda988a175ac

  • SHA512

    84fe8acdef749427cb50292dce6b49b3f93a3195e88fe98ff2d37e2664a26eeb66cdfb9ddd5ac843956d94c38191a398ac48f6a24f18ec74ae6a06fe05ac288c

  • SSDEEP

    98304:zYQ1H4bS8Dd1eojQhDxDKCCY/SresT8qWGpOVXMGnDa+xFE25:cQGbBd1eo+8JSSresT8kum+J5

Score
10/10
hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://94.141.120.170

DES_key
AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.rhdjqosmq.fgclvszcs
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4397
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rhdjqosmq.fgclvszcs/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.rhdjqosmq.fgclvszcs/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4424

Network

        MITRE ATT&CK Mobile v15

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Event Triggered Execution

        1
        T1624

        Broadcast Receivers

        1
        T1624.001

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Download New Code at Runtime

        1
        T1407

        Foreground Persistence

        1
        T1541

        Impair Defenses

        1
        T1629

        Prevent Application Removal

        1
        T1629.001

        Input Injection

        1
        T1516

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Discovery

        Process Discovery

        1
        T1424

        System Information Discovery

        2
        T1426

        System Network Configuration Discovery

        3
        T1422

        System Network Connections Discovery

        1
        T1421

        Lateral Movement

        Collection

        Input Capture

        2
        T1417

        GUI Input Capture

        1
        T1417.002

        Keylogging

        1
        T1417.001

        Screen Capture

        1
        T1513

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Input Injection

        1
        T1516

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.rhdjqosmq.fgclvszcs/app_dex/classes.dex
          Filesize

          2.9MB

          MD5

          ae49661c19512148f67f24ad37a69082

          SHA1

          d1f6ea727f651ff74cc8b4a2b2382778c343c1e3

          SHA256

          b829b24787b06dad1cc66f00f33401ba4a465e33d61421768248895f50521eee

          SHA512

          955d915503f43754701c76ebf4e1c1a2d2fb4e7f84b3a53634f155245b48810cb6d951c4a27505e5b7121296c3807aab553450a478ac9f63f7061577562d067c

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/cache/classes.dex
          Filesize

          1.0MB

          MD5

          cca51404679594decb0ec5566926acaa

          SHA1

          94fc646b1047f3600a052f8c9fccae9bd1281328

          SHA256

          e1db066416428fd12ec1a0e321983b1188986664ede9e9da1026d28efae9c2e1

          SHA512

          ee286a72ae8661e4b759be6a9fb234017376866e38da15acdfb57f4c334bfa951bb433657921eb72f2c116e80df435559c4bbd4c8e36261e5d25d6b2ac99d8bf

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/cache/classes.zip
          Filesize

          1.0MB

          MD5

          0cfb10c2a0d208fa6b97f8353ce971fa

          SHA1

          cc527ad24dd6ebdc9ed367d0e9634da47fc99723

          SHA256

          be106a291296756b977b04cb550a0dc85c7475249ed303c6da4977928411f47a

          SHA512

          11d5dfcf0ff0e17c773195ae0202c8764d9d1be101511a86b21b24f097060fff3249b856c1ad76e6e8383337e7d32245fc7def8b7799e132c8fbfc0446eafbd1

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/no_backup/androidx.work.workdb
          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/no_backup/androidx.work.workdb-journal
          Filesize

          512B

          MD5

          7a40ba36540c9557c6b397fd2a62cb36

          SHA1

          f71dfd07f89f65abf7917041f49d4fbd630f4b97

          SHA256

          6fbbccc3bd8baf8644b5a93ba2ee489b15a02404f1d3d2b78d4826570a40a3b4

          SHA512

          84b2c894cd92f1d7e4e690456b9d2d3f2e628d081acfe3a1d2328031b1248cb5319dc326eb05d652870c82837e990e0693baedcd4b6805ec50df75484c8760d5

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/no_backup/androidx.work.workdb-shm
          Filesize

          32KB

          MD5

          bb7df04e1b0a2570657527a7e108ae23

          SHA1

          5188431849b4613152fd7bdba6a3ff0a4fd6424b

          SHA256

          c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

          SHA512

          768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/no_backup/androidx.work.workdb-wal
          Filesize

          108KB

          MD5

          b795d1cd7acb7b0c02cc55bc39c49c5a

          SHA1

          48b826b18f46ab8fdfcae5ae548b3e99e18b14be

          SHA256

          d0fa4b732f02892af8a8ec5ebee07ddbe813604c3de5b25546eb1f6f05da8306

          SHA512

          c17d64c764b0d160ed88663459e5009b53f310375b0f0b37d5a75e4944963646dee8cd96b03119dbead0877b46bb6b05ed3fad31fb33d64973024b23e54e7e8b

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/no_backup/androidx.work.workdb-wal
          Filesize

          173KB

          MD5

          c5523a0de2c507d55a92d3a9a9d3e3f0

          SHA1

          e01f50cf34bda4cb5fc543f1099daffe0df3b7d3

          SHA256

          1167c9778347a7705889bf1b4a292c5779e145be42535acde6c601d7958351b9

          SHA512

          3309354f30f77e5142c0d67f38da301a56fe31fa8e4cee09890222abd4d553e6028b00a2d10928a4d686da60ae277a6873179b25f51132e94e73429d3603e0c9

          Download Submit

        • /data/data/com.rhdjqosmq.fgclvszcs/no_backup/androidx.work.workdb-wal
          Filesize

          16KB

          MD5

          91c2781c55434ae4f4f5aed5d76b8467

          SHA1

          443c4ae6422d1fcb2f14434c44ea207304dcb8c5

          SHA256

          03fe002ff41cb6059d3fd5438c7272c019d7cc8fbe11628ab67594e7e04ff6e6

          SHA512

          fe712d6132ee68487b54448a4fcc27f995c18bd54bd88d88b7c2aa0a0561c58f89398c8fc17e8f08dfd7a63af9b0d7359e89c1ad02b58e48e35b2ff5bc1246c5

          Download Submit

        • /data/user/0/com.rhdjqosmq.fgclvszcs/app_dex/classes.dex
          Filesize

          2.9MB

          MD5

          7835f826386f9b5e765fbdad4833a8c4

          SHA1

          2e79990167e20a7ba00c6cb016e142973f8ee60e

          SHA256

          befeb8732ca84070ee719f9f222b20fe9d6641c5290080db368a84e9e9fffd3e

          SHA512

          76ee2096fc14c16e3a868c27dee7d2f8080ef1a727cd289ba64a013d1b2ecc3a781cc01f9d134b2734af924917bd4145351fbc4ba5bc50cb201940af773d8722

          Download Submit