redhook | ebc4bed126c380cb37e7936b9557e96d41a38989616855bb95c9107ab075daa3

Analysis

max time kernel
149s
max time network
162s
platform
android-11_x64
resource
android-x64-arm64-20250619-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250619-enlocale:en-usos:android-11-x64system
submitted
25/08/2025, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
128_1__7.7.1.apk
Size 12.7MB
Sample250825-shffdayls7
SHA256 ebc4bed126c380cb37e7936b9557e96d41a38989616855bb95c9107ab075daa3
MD5 7d3194790e30f8ca6f0b8c4c0cb26b5f
SHA1 fbab438686c1e655d282079c09d6de3a7a8c6dd2
SHA512 2dac3302d32d1755514641656ee86b99556727c0f82be8004bb52d43f6f61eb23d8229931b68540d6b0ce82ba5bfabb34a7005ce0065f69d16255322942c7373
SSDEEP 393216:lkm/x3frqizIamc3HKBIsCIDKORsRK9VE:lkUJIamc66sfDKOqIY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection credential_access defense_evasion discovery redhook infostealer rat trojan

Malware Config

Signatures

RedHook
RedHook is an Android banking trojan first seen in January 2025.
trojan infostealer rat redhook
Redhook family
redhook

Checks if the Android device is rooted. 1 TTPs 5 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	com.arsryg.auto
/data/local/bin/su	com.arsryg.auto
/data/local/su	com.arsryg.auto
/system/xbin/su	com.arsryg.auto
/sbin/su	com.arsryg.auto

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.arsryg.auto

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.arsryg.auto

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.arsryg.auto

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.arsryg.auto

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.arsryg.auto

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.arsryg.auto

com.arsryg.auto
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks memory information
PID:4659

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/data/com.arsryg.auto/app_crashrecord/1004
Size 226B
SHA256 216ed06559a201f50ccc5185667c5de546b8483d0d076651531d428e058b33a4
MD5 40128db7a04c33bb452ce3ccf5f849d3
SHA1 e8040487f54122d8505f0739e986435f90960acd
SHA512 2aab354efa9b459d6c22f304e9cd032a05e5bbdd5af171ba694fcadaac413a712fc5d70b172f4d329476e975030644c85eaef561250addc60505a2e32e147a11
MD5 SHA1 SHA512

Submit Download

1004

Path /data/data/com.arsryg.auto/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/data/com.arsryg.auto/databases/bugly_db_
Size 60KB
SHA256 6cbed507467f20cb23a26591f798e62102480e2a06df27fc1d17e87ceae1c239
MD5 f03e0961aa3004b74f4f6971cd5e934f
SHA1 364486e585dd117eb5eee6cf22f04e2ade06c8ca
SHA512 0ea16745a1102565c60aa912f4d0c7b5d87458dec6debbfee34a3a3ea8c99e14ac20c01db669a5fa2d470a067669525dac9d337552a60d6e78e84d8f63752d78
SSDEEP 48:TSf5EpAuAriStwwuMN5meposSDGcdCvXK:05EpFAzwqvXK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 6fbec340ad9fa59198fa096e27b31d2f7f885c12a08656789c6272b6f43a87d9
MD5 fa1160e75db6db6801ee300fabe31ae8
SHA1 0520af14addf9f154fe1d0695d20f3e52a13ebda
SHA512 1dcfa30f84e6a3853dae4bd5fd02c5b5e8f58518160f8ca09c3ff7d041b54a30c3246d565ae368ef34af6376e550409275605a37414b048c13aa2f346a6fb890
SSDEEP 6:7+/l9xPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKl0//re:7+tfqLJdeWRmBEyPb00K
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 f99f07aceb3f7c1151eaf6b2839ba65e07c98c6ecc1c75a1222788be5b5acd72
MD5 ecb406a7a4918432ff79fcf39ee49dbc
SHA1 3ed3ba2159bc26086f189b89b07a4db826fe9131
SHA512 ec92d1b8ba93ecdc6450b25613c173c127a7af20ab8af673bad39b9bea9f82afc6927c5618834b3271a6a2228a80166e3f95192af6ad0816f27ee40c83137453
SSDEEP 24:7+tPRqL+gq5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSF:7MpqCf5EpAuAriStwwuMN5meposSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 4e3e40ed5aa370932403ccc471ffb83a8d315ae777b40a41f7bd651d64ea848a
MD5 2c9f1a2580138d7dc91ff44922a756bc
SHA1 c3f32c5e162b2c61f230ea6b112cbbe6451ac2cb
SHA512 edcc36f2cdb0e36c23d09afc6637213ca1bd85c8aea010574ec6ceeb9cc0bd0d7dbd634d79e8879baae336cbefcaa2bbc5dacf7492e5613987f0f12c51eb936b
SSDEEP 24:7+tuvqLMRgq5EpQhyQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSN:7Muvqyf5EpAuAriStwwuMN5meposSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 d1f573d604339be7bf4f636ed2405dbe33369c7ae26df59522e15238b785eaee
MD5 62c8bc47c870f90dc0aceb76057ca375
SHA1 59fa240f79572f58ccb5453d789a05e24b57e0c6
SHA512 9ec3504874b0c7e5e2cccf63de1dd39603ab97ed01e7da6f39dc996872f11672164952a012ca8b00bc285248be67903156704dc520e66ac8df50966ce35800e6
SSDEEP 48:7M2vXKIqXSf5EpAuAriStwwuMN5meposS3:7fvXKIN5EpFAzw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 512B
SHA256 b7e9c524532c42d9484896bb31a9f6d44a7fbe360bf4a1b8aa21de7f2ba4d432
MD5 362d93e2d3ff22d173f1a1bd2c95f9da
SHA1 df25575f30f87c29301fcea9a561eb05e0580800
SHA512 7ee063da410c1398ff36cf92af5bb0c5bde3996c92a9c2692cfe6e0d95af1eac78d63abe01e69cffa954fa4265e500253bceffecb850a5dcecadf58f09bc844e
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/data/com.arsryg.auto/databases/bugly_db_-journal
Size 8KB
SHA256 bcc059b7f4dbabf892b07fd1383220e2cb50d7c32bf68c6403903084e87c2c2d
MD5 ecbc90f79234a707d285c698a0405862
SHA1 cda117dfaa95023266a8fac96c91587a8d010dba
SHA512 65ad6687b3a43a45ec71473e31c43882bbc2aff3c9b6d28fbe79442ec73b3cc86b7e95a75e4ac84a909f6c6556bd7cf8e73d89a1aab60ff16650b4b36a4b2abf
SSDEEP 6:7+/l9WiuHn1e32vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK2:7+tYiu7qLiuWdYRmBEyPbJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_last_us_up_tm

Path /data/data/com.arsryg.auto/files/bugly_last_us_up_tm
Size 13B
SHA256 281405e762ae86831429aa392bee7b1c828d7bc9b3b57b3d0f4a1c9d479016f4
MD5 15eb1c1550d8a45bcfbf2f0ec2a757cb
SHA1 0ab9e75bf9c51322321ba602b8ec41a52f06af10
SHA512 8d305435e5840861c389473a0121916d460eb017ef94932da692064e79a8729d57ed93f6d7eb8b92845ff80ac09c174676b509655a7f4c3f126c8f84549d6303
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads