chinhphu.apk
- SHA256 ebc4bed126c380cb37e7936b9557e96d41a38989616855bb95c9107ab075daa3
-
RedHook payload
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
redhook
https://api.jftxm.xyz
socket.jftxm.xyz
RedHook is an Android banking trojan first seen in January 2025.
| resource | yara_rule |
|---|---|
| sample | family_redhook |
| description | ioc |
|---|---|
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN |
| description | ioc |
|---|---|
| Required by accessibility services to bind with the system. Allows apps to access accessibility features. | android.permission.BIND_ACCESSIBILITY_SERVICE |
| description | ioc |
|---|---|
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
| Allows an application to collect component usage statistics. | android.permission.PACKAGE_USAGE_STATS |
| Allows an app to post notifications. | android.permission.POST_NOTIFICATIONS |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an application to record audio. | android.permission.RECORD_AUDIO |
| Allows an application to read image files from external storage. | android.permission.READ_MEDIA_IMAGES |
| Allows an application to read audio files from external storage. | android.permission.READ_MEDIA_AUDIO |
| Allows an application to read video files from external storage. | android.permission.READ_MEDIA_VIDEO |
| Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES |
| Allows applications to use exact alarm APIs. | android.permission.SCHEDULE_EXACT_ALARM |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
| Allows an application to collect component usage statistics. | android.permission.PACKAGE_USAGE_STATS |
| Allows applications to use exact alarm APIs. | android.permission.SCHEDULE_EXACT_ALARM |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to read SMS messages. | android.permission.READ_SMS |
| Allows an application to access data from sensors that the user uses to measure what is happening inside their body, such as heart rate. | android.permission.BODY_SENSORS |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| chinhphu.apk |
RedHook payload
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.DISABLE_KEYGUARD
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_FINE_LOCATION
android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.GET_PACKAGE_SIZE
android.permission.LOCAL_MAC_ADDRESS
android.permission.CAMERA
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.PACKAGE_USAGE_STATS
android.permission.POST_NOTIFICATIONS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.BROADCAST_STICKY
android.permission.FOREGROUND_SERVICE_SPECIAL_USE
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.VIBRATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.SYSTEM_OVERLAY_WINDOW
android.permission.QUERY_ALL_PACKAGES
android.permission.WRITE_MEDIA_STORAGE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.FOREGROUND_SERVICE
android.permission.RECORD_AUDIO
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_AUDIO
android.permission.READ_MEDIA_VIDEO
android.permission.ACCESS_NETWORK_STATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.BIND_JOB_SERVICE
android.permission.WAKE_LOCK
android.permission.SCHEDULE_EXACT_ALARM
android.permission.WRITE_SETTINGS
android.permission.WRITE_SECURE_SETTINGS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.QUERY_ALL_PACKAGES
android.permission.PACKAGE_USAGE_STATS
android.permission.BIND_DEVICE_ADMIN
android.permission.SCHEDULE_EXACT_ALARM
android.permission.USE_EXACT_ALARM
android.permission.READ_CONTACTS
android.permission.READ_SMS
android.permission.BODY_SENSORS
android.permission.WAKE_LOCK
com.android.providers.media.MediaProvider
android.permission.REORDER_TASKS
android.permission.GET_TASKS
com.arsryg.auto.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION