hook | d49f63396c8824b9efb53fea37273b2a9eebb29bb833064552e64959a54e66da

General

Target
wvPZE8F66U.apk
Size 1.3MB
Sample250901-twbvsattdv
SHA256 1759b9ba03dde81b6513df437fffc722d0f21a5d12226740d30b429a4b6ff289
MD5 ed26bc4655c27afa571d2f22d2b7056b
SHA1 ea37467b3c2408e9b4df4a56b9dead52c629c244
SHA512 8b66f6736932bb20b2f6e868bb5c1a7b6beb6646b641f29f723f9a761507b1d56f2dc06cb2cd13dec6bc4f540bde679e7ab34f60e61a0b51777f5b8c963e3402
SSDEEP 24576:/7v+SrS8GERJz6U0Srxh5h+qwz65Iqj8xlxdhHlzbSRMARtDm4i+SZ9cLMIy:RrS8GER5nEqw2eE8HzcDK+SzcLk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection credential_access defense_evasion discovery hook impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

C2

https://ws.asedkop.world

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	ru.gryao.zlsfwzi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ru.gryao.zlsfwzi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	ru.gryao.zlsfwzi

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ru.gryao.zlsfwzi

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ru.gryao.zlsfwzi

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ru.gryao.zlsfwzi

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ru.gryao.zlsfwzi

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ru.gryao.zlsfwzi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ru.gryao.zlsfwzi

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ru.gryao.zlsfwzi

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ru.gryao.zlsfwzi

ru.gryao.zlsfwzi
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4624

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

3

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/user/0/ru.gryao.zlsfwzi/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/user/0/ru.gryao.zlsfwzi/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 6dc16b31c3563e87d0893708a2e0ffd85ce513e79f5625f40e095041a7fe81ee
MD5 a3d1bb7f747aaf94956b945b2bcd3511
SHA1 b10fa83419f8cbb44e16e08111bb8e7e1967a91f
SHA512 54f56445105c578652f905869b765904b1c2533e81bae903597907aa9ca41fdc8b91b8bfa77835d9a81b7215b7538ec595f78bd52d610b27c62c7677da5d3ff2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/user/0/ru.gryao.zlsfwzi/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/ru.gryao.zlsfwzi/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 d41e04774c949348f5b3cfda00b16e7ef17a6c200e73b693e48c56bfa09cb947
MD5 cea380629c8c5fe51658cd9fc08eaefc
SHA1 17f683557ab78f01930d93569ef44454c36c83d6
SHA512 06805d2d99fcd749370779364274dd8abc793f1ea68ea5ca1cc2fe3b5e272e43a719fcf31e76eed55b7d067655ca802971783b5a573c0a416f92febd3076c8b4
SSDEEP 6:KywhqQBOHDJ9FZde/kPlOERX4PBX4ogLugMBX4suuK+/MGcXldUZhJOw2:KyfHDzdeWRmBEyPbP/yXLUZhJOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/ru.gryao.zlsfwzi/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 eda6f5a56703a938e4402dfec2e82de460f87fd87583bbea4a4229764645cd8d
MD5 344020bb8f24334b290e73dd7c821f6b
SHA1 101195caf27188f023bb773c22f2b607b8f489dd
SHA512 e99a6597a823bef49be0b44afab2766d97188304c6fde1d8868e9b38a1ef1a5a67f026189b7a6858887507acd35d6e464726ca1059f54a57842e13e5a1678f44
SSDEEP 96:0kZ6+hdjnHtDRMpf8UzS5+TD8q0ExPXMu/NKd:nVdjnHt9Mpf8UzS5+TD8q0E5XO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads