hook | 9ba6ece1a921ccf5dd5a13e4fcbf4fa64601d3503a5995ea30f6826eff94afa1

Analysis

max time kernel
149s
max time network
130s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
17-01-2025 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b.apk
Size

4.8MB
MD5

cb76a1cb8638b031c09b02e0d2ee5cbd
SHA1

f078c0c66855873e0fc59f8e89d403da3716b9b7
SHA256

9ba6ece1a921ccf5dd5a13e4fcbf4fa64601d3503a5995ea30f6826eff94afa1
SHA512

34c03f43ebf9c48010dac33ddbeebb90d0bc5747effa26c09c35c8ccc677707e2c0944e12256643f1bd4131f57bb5cc4e4d065fc8bbab8bc1193a3b1c416a28a
SSDEEP

98304:8CRhf2qLFNAHnIB4mugoHMCqHxyOjDOaEVq8sbSh+kdw1ec:8CRx13cO4BgGWxj5EVAbA+k2

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://lankfnajasdfzcvvxzxcrrtfas.pro; http://lankfnajasdfasdfcxcescgt.pro; http://lankfnajasdfdsfngaaslsss.pro; http://lankfnajasdfanbabwqeda.pro; http://lankfnajasdfasnbadsfaaa.pro

http://lankfnajasdfzcvvxzxcrrtfas.pro

http://lankfnajasdfasdfcxcescgt.pro

http://lankfnajasdfdsfngaaslsss.pro

http://lankfnajasdfanbabwqeda.pro

http://lankfnajasdfasnbadsfaaa.pro

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xcytrjoux.cqhfynogu/app_dex/classes.dex	4456	com.xcytrjoux.cqhfynogu
/data/user/0/com.xcytrjoux.cqhfynogu/app_dex/classes.dex	4456	com.xcytrjoux.cqhfynogu

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xcytrjoux.cqhfynogu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xcytrjoux.cqhfynogu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xcytrjoux.cqhfynogu

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xcytrjoux.cqhfynogu

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xcytrjoux.cqhfynogu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.xcytrjoux.cqhfynogu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.xcytrjoux.cqhfynogu

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xcytrjoux.cqhfynogu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.xcytrjoux.cqhfynogu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xcytrjoux.cqhfynogu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xcytrjoux.cqhfynogu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xcytrjoux.cqhfynogu

com.xcytrjoux.cqhfynogu
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4456

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xcytrjoux.cqhfynogu/app_dex/classes.dex

Filesize
2.1MB

MD5
84b387337b8cda1155bb0e93c5c66bc9

SHA1
2f72795daafceaa3b4c7e0c561a532e05d20ccc7

SHA256
38632b27b7341f780c5d88df35169d0ccb835431344e8e999af927f7a3b4a760

SHA512
3668c0865980ff7f2f5016cb3bb438f0798913c9d7cb205210f569c2eb01c9d14af24d2b2df4c8f339dfd78f0d74ac154fe32ac2a23c7fbfbb16143301592e0c

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/cache/classes.dex

Filesize
986KB

MD5
0a75feeea36223e94d9eea47a11c5fed

SHA1
9dac66821d2859397968e08e1c83a43e18d75070

SHA256
bcc85a8f354ba0215050a72eea36080d6551470d26ebd4e6eedccb44821035a3

SHA512
50774cb7a9f31a8dc9549dbe5822c809b5b55ce04522dd208a7a302df1c39d9eba942107cf2d0a3e55143efc6f3a1f97b6e49cd1a14b37ae55bde4c735fc9e92

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/cache/classes.zip

Filesize
987KB

MD5
42bc93ca169c1118369fcbe933635075

SHA1
85ffea0ff8143039ca2f5644efb78b210255718b

SHA256
0dca412f79a9b50bf05d1aae1efe5bb7958a1e9ab2559bf3f04774499dbb951b

SHA512
a337ed0876b60944c2b93816823f1536ebe3c8c25ee031f303724d3e91d28f78ad20187a5fd85573ff07fed4bbce540890e53fad1444cd834ddffc49667db915

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5e5e7500738405b21b371c7578cbf9d5

SHA1
fe1c59b522e6717d9af20f6adcef524c9d598552

SHA256
0c8c5ffd97c8be805666bbd72203e3d103c858499e3234beb9e7393ef3e9f1b3

SHA512
5453dd190d1ad77f1b5482ec2b64ead18a63046320d660283b9a7b7b249c5a4bdd67afb3b90edf2c66601beff16326e13b6f5a10fbeefd6ea6c5b5f6dcf5a07c

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f71ad69f9b8cacc9cbad173556e415c6

SHA1
e225de6ce8e4fdef6524dd81e7236a38e2821c38

SHA256
2d6731101a24391a30bc4fd5cc0229e25e4f61b8a95cb4db81a4e0f8eb322e90

SHA512
45429dbcb10064a6b1af276864bf17064ed2597f05d9de628f082757c0f26f3b4bbb15f93bec55d32aba1bcda4daa2d158ac48c70d4f9ef8e82ba2bb63c54347

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
89b09e6f998db07f7f56e0984b1c5fda

SHA1
f1976e36b50f32a307173c0b65b6f5e9a07b6089

SHA256
21eba2a0124bd86e0b39ef73ba19bf0d8832289ed6fdf646e68db0cb9e700dc2

SHA512
49f0cb35f2b3436088bd68b93cdfe7eb296d2facf940380ba27f1fdd5c19a585819088d84f73c5fac800b3b6565a55abfe50e2097aab4b669740ca76db86ae47

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
efab73d1be5ccf19e2b010cf63be9eaa

SHA1
712446b69f122f6dd40bf38b5fa4e46c9dafc588

SHA256
369c26931ca96b57758e9071ecaa816929ff0c6d25b92ade8486b53ba3e4cb7f

SHA512
549be431d4ba7bcbc13c0659a9396d0ae019958bab0432e401c53da687b91f82d943a979a15c0b2f23f103fe8fb70a70441d7c923c2c3e519155760e326e762d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads