Extracted

• • Target
    41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863
  • Size 12.7MB
  • SHA256 41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863
  • MD5 411f72e871f9d60180e1ff5350f0ffe1
  • SHA1 657da9cddb34a1b8efa87b895581febd7ab8584c
  • SHA512 277d66c3a91286158fda0d937287730d3f2f2338ab239470af9d0603a5f676d0c469dbf83abcbd476106022cb474213ac14e01ce98bcd18ac38e01522813cff3
  • SSDEEP 393216:Y22EDPgtjMnyToH0qiCamc3YKB4suzDKORsRKD:/MRoUqBamcduswDKOqID
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redhookcollectioncredential_accessdefense_evasiondiscoveryinfostealerpersistencerattrojan

  • RedHook

    RedHook is an Android banking trojan first seen in January 2025.

    trojaninfostealerratredhook

  • Redhook family

    redhook

  • Checks if the Android device is rooted.

    defense_evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Queries information about active data network

    discovery

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Reads information about phone network operator.

    discovery

  • Listens for changes in the sensor environment (might be used to detect emulation)

    defense_evasion
  behavioral1behavioral2