Analysis
- max time kernel
149s - max time network
161s - platform
android-9_x86 - resource
android-x86-arm-20250619-en - resource tags
- submitted
25/08/2025, 15:07
General
- Target 128_1__7.7.1.apk
- Size 12.7MB
- Sample250825-shffdayls7
- SHA256 ebc4bed126c380cb37e7936b9557e96d41a38989616855bb95c9107ab075daa3
Score
10/10
Malware Config
Signatures
- RedHook
RedHook is an Android banking trojan first seen in January 2025.
- Redhook family
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Reads information about phone network operator. 1 TTPs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.arsryg.auto1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Defense Evasion
Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
1System Checks
1Discovery
System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
1004
1004
bugly_db_
bugly_db_-journal
bugly_db_-shm
bugly_db_-wal
bugly_last_us_up_tm