hook | ebf13f12b4710e73c17407303f233c12223b71dbdef15e1ccaed49948252aa92

General

Target
ebf13f12b4710e73c17407303f233c12223b71dbdef15e1ccaed49948252aa92.apk
Size 4.5MB
Sample251017-bpswlsdw9a
SHA256 ebf13f12b4710e73c17407303f233c12223b71dbdef15e1ccaed49948252aa92
MD5 f9d374eb56949609de34030019b601cf
SHA1 8cfdfff43a00180a5fd7625dd6af007ff4d23b7f
SHA512 ed59a7b5dae2b5c4f901e49757aee78b8f3c13a6bbc77cca7907d85a744e3ee9d7dd333ed7101994f12319ea92cf5628ecd4d0c885f3788ad4358ba7edf4c8ed
SSDEEP 98304:bg1TCWVw2LGX3zCaJbxc6UXxkF6jq+ezpo5JELWJro:UEAt6vxc60xkFn+eqGLWJs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection credential_access defense_evasion discovery evasion execution hook impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

C2

http://51.79.190.129

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.rorocilowitupu.yavu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.rorocilowitupu.yavu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.rorocilowitupu.yavu

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rorocilowitupu.yavu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.rorocilowitupu.yavu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.rorocilowitupu.yavu

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.rorocilowitupu.yavu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.rorocilowitupu.yavu
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.rorocilowitupu.yavu

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.rorocilowitupu.yavu

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.rorocilowitupu.yavu

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.rorocilowitupu.yavu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rorocilowitupu.yavu

com.rorocilowitupu.yavu
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4166

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Foreground Persistence

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Hide Artifacts

1

T1628

User Evasion

1

T1628.002

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/user/0/com.rorocilowitupu.yavu/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/user/0/com.rorocilowitupu.yavu/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b56e845aa04feb28a98037f52a200b9568eb1fb04728ade8c1c474b6e651de7c
MD5 1d05b3a5d27f3c4e583279a338a00289
SHA1 a61bec2cab04daef209e4b064f0f47317cd887a7
SHA512 e04abc16e545ae9491c52455adac5fb06b4fa8acd1b8d9eb817f4bbe3d143aa4a9f6e0c4da8f2de9ebe55264564ac1e49355c86db0e8857d0ce4a7867565dd3d
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/user/0/com.rorocilowitupu.yavu/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/com.rorocilowitupu.yavu/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 a8f115c17b14c83612b69da897f5213de5ac67cd3ab8a93e1bb4f4425c7747f1
MD5 98647b8287d3c6793d5d13f4894fe201
SHA1 0923e468b9d750b9278e4d41ad89439ad6187c6c
SHA512 dc1c6f614f1efa15f23114b08ba374df9461fa865eb1e70fd27ee54dcb47f9b588a38415c34d49d6de7ef4bc999d249135ca41b47a65c19cc8abd02d011af4ff
SSDEEP 6:KWiTn9FZdKEAlOERX4PBX4ogLugMBX4suuK+/HEltK6COi60otiOw2:KVT9zdKBRmBEyPbP/kl46Bi6RtiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/com.rorocilowitupu.yavu/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 82a1472a175deb251ede88be69d2d448eb10bce3db503d7dae171b866c586a37
MD5 23d4baeac12568c031b296c2985a1b21
SHA1 0768e0b9c31d1cb699ca26b7b8a04a1547ca59ba
SHA512 e74389745c4195a44941225dcdac51ec2d54ed0e8802c0b9a3e53d788ea9e8921151d0140bf0d91f493f9751b6114ad327dacde67175a6b0479e6ccbffff93fc
SSDEEP 48:y4aDZY66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWgU6xl73JcXSMmcf:9kZ6+hdjnHtDRMpf8UzS5+TD8q0ExPrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/com.rorocilowitupu.yavu/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 4c4d1356390241ed7ff223225a2d9029c38368e235cb4d2a80ad8553c4e170c9
MD5 2b16da147883032284a084250fc7cac7
SHA1 f4d4bba39aacae50f6453f55e3703c9eab4e84dc
SHA512 37c5b450d182bd1d2e1b577ff0e014b6dcfe0d56ae48151c7175b167ea7de9b366452f0c73ad7e91cd9ab937c716a1574f66f73e6d98c6110685e452fca656d5
SSDEEP 24:bxvGrBVYfUvgDoudv+dvjvS4LOxvXvDwvgvGrBVYx/dvw9nvs:orBVYt8sSrBVYEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads