redhook | 41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863

General

Target
41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863
Size 12.7MB
Sample250807-sbc2nsxms2
SHA256 41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863
MD5 411f72e871f9d60180e1ff5350f0ffe1
SHA1 657da9cddb34a1b8efa87b895581febd7ab8584c
SHA512 277d66c3a91286158fda0d937287730d3f2f2338ab239470af9d0603a5f676d0c469dbf83abcbd476106022cb474213ac14e01ce98bcd18ac38e01522813cff3
SSDEEP 393216:Y22EDPgtjMnyToH0qiCamc3YKB4suzDKORsRKD:/MRoUqBamcduswDKOqID
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redhook

Malware Config

Extracted

Family

redhook

C2

https://api5.jftxm.xyz
skt5.jftxm.xyz

Signatures

RedHook payload 1 IoCs

resource	yara_rule
sample	family_redhook

Redhook family
redhook

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 24 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to access data from sensors that the user uses to measure what is happening inside their body, such as heart rate.	android.permission.BODY_SENSORS

File Explorer

41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863

.apk 12.7MB

41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863

SHA256 41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863
MD5 411f72e871f9d60180e1ff5350f0ffe1
SHA1 657da9cddb34a1b8efa87b895581febd7ab8584c
SHA512 277d66c3a91286158fda0d937287730d3f2f2338ab239470af9d0603a5f676d0c469dbf83abcbd476106022cb474213ac14e01ce98bcd18ac38e01522813cff3
SSDEEP 393216:Y22EDPgtjMnyToH0qiCamc3YKB4suzDKORsRKD:/MRoUqBamcduswDKOqID
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

RedHook payload

com.arsryg.auto

android.permission.MANAGE_EXTERNAL_STORAGE android.permission.DISABLE_KEYGUARD android.permission.SYSTEM_ALERT_WINDOW android.permission.ACCESS_FINE_LOCATION android.permission.BIND_ACCESSIBILITY_SERVICE android.permission.GET_PACKAGE_SIZE android.permission.LOCAL_MAC_ADDRESS android.permission.CAMERA android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.INTERNET android.permission.PACKAGE_USAGE_STATS android.permission.POST_NOTIFICATIONS android.permission.RECEIVE_BOOT_COMPLETED android.permission.FOREGROUND_SERVICE android.permission.BROADCAST_STICKY android.permission.FOREGROUND_SERVICE_SPECIAL_USE android.permission.KILL_BACKGROUND_PROCESSES android.permission.VIBRATE android.permission.SYSTEM_ALERT_WINDOW android.permission.SYSTEM_OVERLAY_WINDOW android.permission.QUERY_ALL_PACKAGES android.permission.WRITE_MEDIA_STORAGE android.permission.MODIFY_AUDIO_SETTINGS android.permission.FOREGROUND_SERVICE android.permission.RECORD_AUDIO android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_AUDIO android.permission.READ_MEDIA_VIDEO android.permission.ACCESS_NETWORK_STATE android.permission.REQUEST_INSTALL_PACKAGES android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_NETWORK_STATE android.permission.BIND_JOB_SERVICE android.permission.WAKE_LOCK android.permission.SCHEDULE_EXACT_ALARM android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.SYSTEM_ALERT_WINDOW android.permission.READ_PHONE_STATE android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_COARSE_LOCATION android.permission.QUERY_ALL_PACKAGES android.permission.PACKAGE_USAGE_STATS android.permission.BIND_DEVICE_ADMIN android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.READ_CONTACTS android.permission.READ_SMS android.permission.BODY_SENSORS android.permission.WAKE_LOCK com.android.providers.media.MediaProvider android.permission.REORDER_TASKS android.permission.GET_TASKS com.arsryg.auto.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.arsryg.auto.NormalWebActivity

com.arsryg.auto.login.activity.ActivityShow

com.arsryg.auto.login.activity.ActivityShow2

com.arsryg.auto.login.activity.ActivityShow3

com.arsryg.auto.login.activity.ActivityLogin

com.arsryg.auto.login.activity.ActivityLogin2

com.arsryg.auto.login.activity.ActivityLogin3

com.arsryg.auto.login.activity.ActivityInputUserInfo

com.arsryg.auto.login.activity.ActivityUploadIdCard

com.arsryg.auto.login.activity.ActivitySplash

android.intent.action.MAIN

com.yhao.floatwindow.FloatActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.luck.picture.lib.basic.PictureSelectorSupporterActivity

com.luck.picture.lib.basic.PictureSelectorTransparentActivity

com.ypx.imagepicker.activity.crop.MultiImageCropActivity

com.ypx.imagepicker.activity.preview.MultiImagePreviewActivity

com.ypx.imagepicker.activity.singlecrop.SingleCropActivity

com.ypx.imagepicker.activity.multi.MultiImagePickerActivity

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

com.fanjun.keeplive.activity.OnePixelActivity

Android Permissions

41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863

Permissions

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.DISABLE_KEYGUARD

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_FINE_LOCATION

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.GET_PACKAGE_SIZE

android.permission.LOCAL_MAC_ADDRESS

android.permission.CAMERA

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.PACKAGE_USAGE_STATS

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.BROADCAST_STICKY

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_MEDIA_STORAGE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.RECORD_AUDIO

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_MEDIA_VIDEO

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.BIND_JOB_SERVICE

android.permission.WAKE_LOCK

android.permission.SCHEDULE_EXACT_ALARM

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.QUERY_ALL_PACKAGES

android.permission.PACKAGE_USAGE_STATS

android.permission.BIND_DEVICE_ADMIN

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.READ_CONTACTS

android.permission.READ_SMS

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863

com.arsryg.auto.NormalWebActivity

com.arsryg.auto.login.activity.ActivityShow

com.arsryg.auto.login.activity.ActivityShow2

com.arsryg.auto.login.activity.ActivityShow3

com.arsryg.auto.login.activity.ActivityLogin

com.arsryg.auto.login.activity.ActivityLogin2

com.arsryg.auto.login.activity.ActivityLogin3

com.arsryg.auto.login.activity.ActivityInputUserInfo

com.arsryg.auto.login.activity.ActivityUploadIdCard

com.arsryg.auto.login.activity.ActivitySplash

com.yhao.floatwindow.FloatActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.luck.picture.lib.basic.PictureSelectorSupporterActivity

com.luck.picture.lib.basic.PictureSelectorTransparentActivity

com.ypx.imagepicker.activity.crop.MultiImageCropActivity

com.ypx.imagepicker.activity.preview.MultiImagePreviewActivity

com.ypx.imagepicker.activity.singlecrop.SingleCropActivity

com.ypx.imagepicker.activity.multi.MultiImagePickerActivity

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

com.fanjun.keeplive.activity.OnePixelActivity

com.arsryg.auto.service.MyNotifyService

com.arsryg.auto.service.AccessibilityMService

com.arsryg.auto.service.MediaProjectionService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.luck.picture.lib.service.ForegroundService

com.fanjun.keeplive.service.LocalService

com.fanjun.keeplive.service.HideForegroundService

com.fanjun.keeplive.service.JobHandlerService

com.fanjun.keeplive.service.RemoteService

com.arsryg.auto.service.AlarmReceiver

com.arsryg.auto.service.UnlockReceiver

com.arsryg.auto.service.MyDeviceAdminReceiver

com.fanjun.keeplive.receiver.NotificationClickReceiver

androidx.core.content.FileProvider

com.blankj.utilcode.util.UtilsFileProvider

com.luck.picture.lib.basic.PictureFileProvider

com.ypx.imagepicker.utils.PickerFileProvider

me.jessyan.autosize.InitProvider

Android Permissions

41d09fb33d7696833c11c739a3b0929cd0bff70c29c1a8d00a9c2041c8d0b863