hook | 9ba6ece1a921ccf5dd5a13e4fcbf4fa64601d3503a5995ea30f6826eff94afa1

Analysis

max time kernel
149s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
18-01-2025 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ba6ece1a921ccf5dd5a13e4fcbf4fa64601d3503a5995ea30f6826eff94afa1.apk
Size

4.8MB
MD5

cb76a1cb8638b031c09b02e0d2ee5cbd
SHA1

f078c0c66855873e0fc59f8e89d403da3716b9b7
SHA256

9ba6ece1a921ccf5dd5a13e4fcbf4fa64601d3503a5995ea30f6826eff94afa1
SHA512

34c03f43ebf9c48010dac33ddbeebb90d0bc5747effa26c09c35c8ccc677707e2c0944e12256643f1bd4131f57bb5cc4e4d065fc8bbab8bc1193a3b1c416a28a
SSDEEP

98304:8CRhf2qLFNAHnIB4mugoHMCqHxyOjDOaEVq8sbSh+kdw1ec:8CRx13cO4BgGWxj5EVAbA+k2

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://lankfnajasdfzcvvxzxcrrtfas.pro; http://lankfnajasdfasdfcxcescgt.pro; http://lankfnajasdfdsfngaaslsss.pro; http://lankfnajasdfanbabwqeda.pro; http://lankfnajasdfasnbadsfaaa.pro

http://lankfnajasdfzcvvxzxcrrtfas.pro

http://lankfnajasdfasdfcxcescgt.pro

http://lankfnajasdfdsfngaaslsss.pro

http://lankfnajasdfanbabwqeda.pro

http://lankfnajasdfasnbadsfaaa.pro

DES_key

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xcytrjoux.cqhfynogu/app_dex/classes.dex	4439	com.xcytrjoux.cqhfynogu
/data/user/0/com.xcytrjoux.cqhfynogu/app_dex/classes.dex	4439	com.xcytrjoux.cqhfynogu

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xcytrjoux.cqhfynogu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xcytrjoux.cqhfynogu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xcytrjoux.cqhfynogu

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xcytrjoux.cqhfynogu

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xcytrjoux.cqhfynogu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.xcytrjoux.cqhfynogu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.xcytrjoux.cqhfynogu

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xcytrjoux.cqhfynogu

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xcytrjoux.cqhfynogu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.xcytrjoux.cqhfynogu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xcytrjoux.cqhfynogu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xcytrjoux.cqhfynogu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xcytrjoux.cqhfynogu

com.xcytrjoux.cqhfynogu
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4439

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.xcytrjoux.cqhfynogu/app_dex/classes.dex

Filesize
2.1MB

MD5
84b387337b8cda1155bb0e93c5c66bc9

SHA1
2f72795daafceaa3b4c7e0c561a532e05d20ccc7

SHA256
38632b27b7341f780c5d88df35169d0ccb835431344e8e999af927f7a3b4a760

SHA512
3668c0865980ff7f2f5016cb3bb438f0798913c9d7cb205210f569c2eb01c9d14af24d2b2df4c8f339dfd78f0d74ac154fe32ac2a23c7fbfbb16143301592e0c

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/cache/classes.dex

Filesize
986KB

MD5
0a75feeea36223e94d9eea47a11c5fed

SHA1
9dac66821d2859397968e08e1c83a43e18d75070

SHA256
bcc85a8f354ba0215050a72eea36080d6551470d26ebd4e6eedccb44821035a3

SHA512
50774cb7a9f31a8dc9549dbe5822c809b5b55ce04522dd208a7a302df1c39d9eba942107cf2d0a3e55143efc6f3a1f97b6e49cd1a14b37ae55bde4c735fc9e92

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/cache/classes.zip

Filesize
987KB

MD5
42bc93ca169c1118369fcbe933635075

SHA1
85ffea0ff8143039ca2f5644efb78b210255718b

SHA256
0dca412f79a9b50bf05d1aae1efe5bb7958a1e9ab2559bf3f04774499dbb951b

SHA512
a337ed0876b60944c2b93816823f1536ebe3c8c25ee031f303724d3e91d28f78ad20187a5fd85573ff07fed4bbce540890e53fad1444cd834ddffc49667db915

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
21dd2478d977c9283ab3937cefb42662

SHA1
093a4315c473f821729934a6c04d46ed85598287

SHA256
4a09f5b938051d065f4247c1fbb4870fdb566e663d7deb12574d2d62487e5876

SHA512
9e2d42a908fc717ca7569a52bbad1f5016896c8eef724bd8676040c531782df760bc11ed83de654ae8cdf2fe5cfe8612da26a4d82373811d7140c0c25891019f

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
72fccdd8f861d4aad00c1c7af425834b

SHA1
760becc47c732645a1f2de16c34b6c7a5ed501fc

SHA256
54113c46eceec1c01eea252fdf8892bc47b51776202140fe85233f4da8a34d1c

SHA512
ec1167122ef275372c4564962802642f6827d517dd0d47f3620b706abba7336175f57b43d17e043ac2b9981fa665d4d4826fc61c824b3c87ac2b15009d487d15

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
de77889b1d7ec8c908a6d0f445d9a8cd

SHA1
cf84434bac920e14bac30dc8d5cd342fe94690db

SHA256
3b49b36423a3875b31467c77a1552fb4ed5b0d3cc4e2602546c4c93adc76f7ac

SHA512
848dabdbb00934870c428dd1371b16c94d33700de75fd012a9dc21bd072a9c27bc4e348a61c8983942d849dd88f065588faec5bb7d7d10d85ccded5c32d342d3

Download Submit
/data/user/0/com.xcytrjoux.cqhfynogu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
1b042203f3c2b3536795a9fcd8adbfde

SHA1
f7770b165506dcc75c389c57a961514d1ee13003

SHA256
9774b92d9aaddff0b2f18878b376163af3813d4512c02f0887e506b51ca1de01

SHA512
2e729d360540c7f53163c739fb4a98029f98d05311f83ee40c00389e99cb21c08a96f34ccd7c6215a4358b53f80dc557caf56b6cbf2a43016b62a79e9be86f00

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads