redhook | 2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc[.]apk

General

Target
2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc.apk
Size 11.9MB
Sample251202-ptcxvavrcj
SHA256 2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc
MD5 3f95de9793139f4c490a83fa46e3c6a8
SHA1 00ac807c434389424759c6abe9042c0026f25c3b
SHA512 95db2498fa24b7a3d0e304a4983723e6d19182d4c996b1edd5f1093dfd1d68225efba50fb877a36aa9cdee16cc1537063def6f23c45bbf11c3809c6748741f9e
SSDEEP 196608:iw4yh/fl+gKp7U99K3K8BPIk2Ok85uKB/rsjO2JDKORsLw8I4:X4Ad+gKpHa8BQk2O14KBTsqwDKORsLI4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redhook

Malware Config

Extracted

Family

redhook

C2

https://api12.b0tti.xyz
skt12.b0tti.xyz

Signatures

RedHook payload 1 IoCs

resource	yara_rule
sample	family_redhook

Redhook family
redhook

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 24 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to access data from sensors that the user uses to measure what is happening inside their body, such as heart rate.	android.permission.BODY_SENSORS

File Explorer

2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc.apk

.apk 11.9MB

2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc.apk

SHA256 2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc
MD5 3f95de9793139f4c490a83fa46e3c6a8
SHA1 00ac807c434389424759c6abe9042c0026f25c3b
SHA512 95db2498fa24b7a3d0e304a4983723e6d19182d4c996b1edd5f1093dfd1d68225efba50fb877a36aa9cdee16cc1537063def6f23c45bbf11c3809c6748741f9e
SSDEEP 196608:iw4yh/fl+gKp7U99K3K8BPIk2Ok85uKB/rsjO2JDKORsLw8I4:X4Ad+gKpHa8BQk2O14KBTsqwDKORsLI4
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

RedHook payload

com.arsryg.auto

android.permission.MANAGE_EXTERNAL_STORAGE android.permission.DISABLE_KEYGUARD android.permission.SYSTEM_ALERT_WINDOW android.permission.ACCESS_FINE_LOCATION android.permission.BIND_ACCESSIBILITY_SERVICE android.permission.GET_PACKAGE_SIZE android.permission.LOCAL_MAC_ADDRESS android.permission.CAMERA android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.INTERNET android.permission.PACKAGE_USAGE_STATS android.permission.POST_NOTIFICATIONS android.permission.RECEIVE_BOOT_COMPLETED android.permission.FOREGROUND_SERVICE android.permission.BROADCAST_STICKY android.permission.FOREGROUND_SERVICE_SPECIAL_USE android.permission.KILL_BACKGROUND_PROCESSES android.permission.VIBRATE android.permission.SYSTEM_ALERT_WINDOW android.permission.SYSTEM_OVERLAY_WINDOW android.permission.QUERY_ALL_PACKAGES android.permission.WRITE_MEDIA_STORAGE android.permission.MODIFY_AUDIO_SETTINGS android.permission.FOREGROUND_SERVICE android.permission.RECORD_AUDIO android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_AUDIO android.permission.READ_MEDIA_VIDEO android.permission.ACCESS_NETWORK_STATE android.permission.REQUEST_INSTALL_PACKAGES android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_NETWORK_STATE android.permission.BIND_JOB_SERVICE android.permission.WAKE_LOCK android.permission.SCHEDULE_EXACT_ALARM android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.SYSTEM_ALERT_WINDOW android.permission.READ_PHONE_STATE android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_COARSE_LOCATION android.permission.QUERY_ALL_PACKAGES android.permission.PACKAGE_USAGE_STATS android.permission.BIND_DEVICE_ADMIN android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.READ_CONTACTS android.permission.READ_SMS android.permission.BODY_SENSORS android.permission.WAKE_LOCK com.android.providers.media.MediaProvider android.permission.REORDER_TASKS android.permission.GET_TASKS com.arsryg.auto.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.arsryg.auto.NormalWebActivity

com.arsryg.auto.login.activity.ActivityShow

com.arsryg.auto.login.activity.ActivityShow2

com.arsryg.auto.login.activity.ActivityShow3

com.arsryg.auto.login.activity.ActivityLogin

com.arsryg.auto.login.activity.ActivityLogin2

com.arsryg.auto.login.activity.ActivityLogin3

com.arsryg.auto.login.activity.ActivityInputUserInfo

com.arsryg.auto.login.activity.ActivityUploadIdCard

com.arsryg.auto.login.activity.ActivitySplash

android.intent.action.MAIN

com.yhao.floatwindow.FloatActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.luck.picture.lib.basic.PictureSelectorSupporterActivity

com.luck.picture.lib.basic.PictureSelectorTransparentActivity

com.ypx.imagepicker.activity.crop.MultiImageCropActivity

com.ypx.imagepicker.activity.preview.MultiImagePreviewActivity

com.ypx.imagepicker.activity.singlecrop.SingleCropActivity

com.ypx.imagepicker.activity.multi.MultiImagePickerActivity

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

com.fanjun.keeplive.activity.OnePixelActivity

Android Permissions

2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc.apk

Permissions

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.DISABLE_KEYGUARD

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_FINE_LOCATION

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.GET_PACKAGE_SIZE

android.permission.LOCAL_MAC_ADDRESS

android.permission.CAMERA

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.PACKAGE_USAGE_STATS

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.BROADCAST_STICKY

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_MEDIA_STORAGE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.RECORD_AUDIO

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_MEDIA_VIDEO

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.BIND_JOB_SERVICE

android.permission.WAKE_LOCK

android.permission.SCHEDULE_EXACT_ALARM

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.QUERY_ALL_PACKAGES

android.permission.PACKAGE_USAGE_STATS

android.permission.BIND_DEVICE_ADMIN

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.READ_CONTACTS

android.permission.READ_SMS

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc.apk

com.arsryg.auto.NormalWebActivity

com.arsryg.auto.login.activity.ActivityShow

com.arsryg.auto.login.activity.ActivityShow2

com.arsryg.auto.login.activity.ActivityShow3

com.arsryg.auto.login.activity.ActivityLogin

com.arsryg.auto.login.activity.ActivityLogin2

com.arsryg.auto.login.activity.ActivityLogin3

com.arsryg.auto.login.activity.ActivityInputUserInfo

com.arsryg.auto.login.activity.ActivityUploadIdCard

com.arsryg.auto.login.activity.ActivitySplash

com.yhao.floatwindow.FloatActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.luck.picture.lib.basic.PictureSelectorSupporterActivity

com.luck.picture.lib.basic.PictureSelectorTransparentActivity

com.ypx.imagepicker.activity.crop.MultiImageCropActivity

com.ypx.imagepicker.activity.preview.MultiImagePreviewActivity

com.ypx.imagepicker.activity.singlecrop.SingleCropActivity

com.ypx.imagepicker.activity.multi.MultiImagePickerActivity

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

com.fanjun.keeplive.activity.OnePixelActivity

com.arsryg.auto.service.MyNotifyService

com.arsryg.auto.service.AccessibilityMService

com.arsryg.auto.service.MediaProjectionService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.luck.picture.lib.service.ForegroundService

com.fanjun.keeplive.service.LocalService

com.fanjun.keeplive.service.HideForegroundService

com.fanjun.keeplive.service.JobHandlerService

com.fanjun.keeplive.service.RemoteService

com.arsryg.auto.service.AlarmReceiver

com.arsryg.auto.service.UnlockReceiver

com.arsryg.auto.service.MyDeviceAdminReceiver

com.fanjun.keeplive.receiver.NotificationClickReceiver

androidx.core.content.FileProvider

com.blankj.utilcode.util.UtilsFileProvider

com.luck.picture.lib.basic.PictureFileProvider

com.ypx.imagepicker.utils.PickerFileProvider

me.jessyan.autosize.InitProvider

Android Permissions

2edc7cbc0dce61739a4d977acd8b6e6940a817d4e698cbccaa8ce1ddbe0a7bbc.apk