redhook | 41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863

Analysis

max time kernel
149s
max time network
156s
platform
android-11_x64
resource
android-x64-arm64-20250619-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250619-enlocale:en-usos:android-11-x64system
submitted
07/08/2025, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863.apk
Size 12.7MB
Sample250807-sbc2nsxms2
SHA256 41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863
MD5 411f72e871f9d60180e1ff5350f0ffe1
SHA1 657da9cddb34a1b8efa87b895581febd7ab8584c
SHA512 277d66c3a91286158fda0d937287730d3f2f2338ab239470af9d0603a5f676d0c469dbf83abcbd476106022cb474213ac14e01ce98bcd18ac38e01522813cff3
SSDEEP 393216:Y22EDPgtjMnyToH0qiCamc3YKB4suzDKORsRKD:/MRoUqBamcduswDKOqID
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redhook collection credential_access defense_evasion discovery infostealer rat trojan

Malware Config

Signatures

RedHook
RedHook is an Android banking trojan first seen in January 2025.
trojan infostealer rat redhook
Redhook family
redhook

Checks if the Android device is rooted. 1 TTPs 5 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.arsryg.auto
/sbin/su	com.arsryg.auto
/data/local/xbin/su	com.arsryg.auto
/data/local/bin/su	com.arsryg.auto
/data/local/su	com.arsryg.auto

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.arsryg.auto

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.arsryg.auto

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.arsryg.auto

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.arsryg.auto

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.arsryg.auto

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.arsryg.auto

com.arsryg.auto
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks memory information
PID:4808

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/data/com.arsryg.auto/app_crashrecord/1004
Size 234B
SHA256 d14a5a5b36059b28380709bf0e80b86f162b7f45fbfdd8a918020a6a6da1173f
MD5 d3574c24161829e45600e268f4e0f93e
SHA1 4231a9a2934e4f786156590a413808873e66d1f1
SHA512 037e91a7f7ea0d6afc39fe0ff3b687087d4d827e76553df9bfb37fbf1b24d95139ad9d86084e0e90feb23fd297f92ca17204ac43793db14f83d7fd60361eaa10
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.arsryg.auto/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/com.arsryg.auto/databases/bugly_db_
Size 60KB
SHA256 c47fb01e2b49480229ace828b65243ad6a1d0fe61e1c935422026a67fce180b0
MD5 61999de5a95d9046d8b5b816ae2ac2b3
SHA1 4d73d910ece9dcb1b86b811ef46d56883c89b4da
SHA512 0d09cc6bf0eac65c19b60f73b7a53bb8b405ae3ec5cbf5627b2f7e54e08fa4ca3b3cb58654ed2054c1910f92d35c90a6b271b4fdb5d5b308e33c562d72cbc0de
SSDEEP 48:T25f5EpAuAriStwwuMN5meposSOyGKcBAmSo0Jr/s:ip5EpFAzw+KcIoH
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 ed59f5d999cf35b8d7b1d5357d253a0dc23ace8687422a15e035659ca6e5f9fd
MD5 a08e4a1ee6368e4df60ed32e4a0d22c5
SHA1 0176e5600f7076961bd9114b0b4aca2e34040c9b
SHA512 6a48c648f8f3239e7b8ed55baed6a31a7ff3daafe3ffadad2c2e6e1aa41d072fbd345fe8b1e56121492797302fff91814b8c141d63d29eb5b49524d06121e12a
SSDEEP 6:7+/l9CPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK6Ous//7n:7+tsqLJdeWRmBEyPbZOB7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 8f1e50d9fdfbe4217d67ba509d5c922be4a2c23aab3c00fc410cdeb7350e966e
MD5 699392ca1171d6a3ef2953cd9f34e1a6
SHA1 86baf4207d95fd80ad3e99d4cc1fc609620d0dd2
SHA512 157374dabbd1958eca625d5d00ef1d8f5f68ddea32256ecbd34b3efc138abbe48f3fd4de6d2cf152680540cfb3178247d169031c01bc07597aafe9a2283ffddd
SSDEEP 24:7+tBsWqL+gq5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSU:7MBsWqCf5EpAuAriStwwuMN5meposSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 9a1c7bf6f0ac5e13ab4856d59a8d51c9f5605d4ef4da426de55bec26446e6c29
MD5 e5d70ca132d08b906ae42146b835e7fc
SHA1 e7b3911a951396ea2164d91f5d5952e6027c742d
SHA512 eff822976c8cf185d3898a272d38146bc84668ce98f8b3add904c259941e373ffe3784293e0eaf4bc5e3c9d54189e063951488692dda2b601c315c6fa1eec930
SSDEEP 24:7+tRGvqLMRgq5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSJ:7MR0qyf5EpAuAriStwwuMN5meposSJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 139febda9bfd179999ec0b53eed064656ba375f78bdea0716d41a97d993cc939
MD5 2e6121b7c28a34ce6f969d02453d24b7
SHA1 de4dd3d13edc2c6aeca9dd236e0e066b71d17cf4
SHA512 07f79ad9f1316fe8092ea0bccbe1cb8a09de9100c831ce26e2b08967d4792b2ee57f6ab86e2244df26269ed2ae98129bc5d5b01a6b370a3062eb0ec57c3aa5c1
SSDEEP 48:7MoBAoKlqyf5EpAuAriStwwuMN5meposSB:7lBKld5EpFAzwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 512B
SHA256 54c1df1617c805cc6a253a2fd31e9f03a4eb62825db6006a7a6762d609772143
MD5 aee39d8fceea8cc1d3f01675acfce02a
SHA1 721530842a43fe21cc1de73d05618fabbd2ce075
SHA512 6c8f5cdd3be6331cdee0105a52a73be048c42024f6c35f34c4476c81ea9670f7af3ba1bc77a7cb9a2bba01435467a662b83c5366a06277848b208c6cc517b6e4
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 522d976c703b78a6df7a275be10c8d8c84dab3225193153048e9c59bca4724a9
MD5 99ba842b8dc0ff2601bdcd69df3ad48d
SHA1 aa887e59927bbc83b059ab734dc300e6f59c09f5
SHA512 6a6bdcb41fcf4f26011e92fccda400e324faec385953e6ef436e573d4a6ed1ad0059a3fc4b870cf3bc2183df39628c55a2507a7ade975c494207f08ad11d1bad
SSDEEP 6:7+/l9tn1Ovg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKb:7+tEqLiuWdYRmBEyPbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_last_us_up_tm

Path /data/data/com.arsryg.auto/files/bugly_last_us_up_tm
Size 13B
SHA256 432a7ab8cb8d575044693b52dc592103e7eab2812f0820523748e80f34faa6d8
MD5 e7b7648edd45dd72f5be37900edca71c
SHA1 7764a612a619f3ef3b9694f9165300a33ac32b6f
SHA512 78a633a7e046e873239251d8649faaccb947166bfbe194135e14cd10a8b5c651803d96a14333b488c0c14da6a923572810166965d996c9510f31430048610745
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads