Analysis

  • max time kernel
    49s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    25-11-2024 22:04

General

  • Target

    0e4a594eff2959083c749e4ac259740e9910085bbf1fe985cebfd46e1fa50446.apk

  • Size

    1.1MB

  • MD5

    011273d9445d0f8bd4147bb4a4ffbb60

  • SHA1

    4e3b907d12936dc380247c4ef1b3e67cc3cb5a08

  • SHA256

    0e4a594eff2959083c749e4ac259740e9910085bbf1fe985cebfd46e1fa50446

  • SHA512

    1b2491bc8dde0247e0e61292b36c18143a917ddf02a4e57c55816e17a557d0ea7a0fd4e85f423522f8209f5d0772a641ffce3b3fbc019a765e4afee70dee3131

  • SSDEEP

    24576:gaJoccDxQwEBswcPwu8lSkuXYwZI+D4o1qojywog/B5wfi:gGocEyfSwPWm+iXwog/Ufi

Malware Config

Extracted

Family

hook

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 10 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.lolejikafute.gozini
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Requests enabling of the accessibility settings.
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4662

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.lolejikafute.gozini/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/user/0/com.lolejikafute.gozini/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    70e1ca4ffb6830d6a4543d0502e6196f

    SHA1

    da95e3a46ed75f67b84f15842a8d05e28ee72399

    SHA256

    cc4ad6c6141009247fc4b56a03580fbc623112d1929646ad4a5d7a998d691df3

    SHA512

    1aa4bd98b3be652b5178c64f3fea0902c549a2c4b4ccc13c4bc0bb1ca59437430a9a4acf28096a702ee412c27bc26494b7a54ef2a58b1628e7893ca859a6d333

  • /data/user/0/com.lolejikafute.gozini/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/user/0/com.lolejikafute.gozini/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    861c12e851d677403cd714413775bf58

    SHA1

    a902563bcf74043c0a3b653557a31e60b3a406ef

    SHA256

    29e6a7d328addd35a387a6a689e826bbcd37cec25ad0c821c26776f5bd0148cb

    SHA512

    628ea86f40cbf3e5c404804fcea92e3f93dc9c56bedf1e1c28c5dea4af572c44e1b26fe731d11da06df8cc9cd36396f4da539cca51ed13478f2277061cd93e99

  • /data/user/0/com.lolejikafute.gozini/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    687156b829401b0001feea7835421fae

    SHA1

    f94d9282867550d0b3812a080f27e4823fe33d64

    SHA256

    c70928970881375b6b0415516d36582101ee1a61a27c4181029679f06c171653

    SHA512

    6caf33cb3322b6b90d9237eb88a42398a168fc49ca991ef1ce91f312e0ae83f517a6be430ba16c267a04e09ff5d703890e0d4dd9d93eb00f874c641d77e016ac

  • /data/user/0/com.lolejikafute.gozini/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    98175a0d6d0066bd8da0d087e03f0927

    SHA1

    b97d7be0381632892693ab7178b417fcc5598945

    SHA256

    f742c493084c315d788599f7d4c61f7a544b471e7c4a89c35dfb445a4d1b7655

    SHA512

    af5c88ba8083a7e1c9028fa0654bcd2a9e23517eaf06c4c938db8486123de3055c77fe0116a5dfa5d499a597a7ae24b0ea483ee45ae89bd355143bd853415b17