hook | 5687b460c2da0dfe925a549c595dd4523a92d2f41a4b74095990de35bce25784

Analysis

max time kernel
179s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
23-06-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5687b460c2da0dfe925a549c595dd4523a92d2f41a4b74095990de35bce25784.apk
Size

2.9MB
MD5

09b45e8390d1717a4b8b507031fc56d1
SHA1

a34a7b69fee1e5a0c74a955070753ef553272961
SHA256

5687b460c2da0dfe925a549c595dd4523a92d2f41a4b74095990de35bce25784
SHA512

7dade2ad54abc85943b919b78b5675084ce987594a7733ad8130603eedafcfd314d48a1d91638d585c4585160d34032dc7718bdc30898277a55fd152ae308bc6
SSDEEP

49152:lU5O8gi0yfz0HuNDajlN67M0dSvBWZhRGm+VT5Q50qs0ClXeHpg/Mg:laOOfYHupS67MS9ZhRGlQ5X4X8g

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Processes:

com.kututufehogi.siva

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kututufehogi.siva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kututufehogi.siva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.kututufehogi.siva

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.kututufehogi.siva
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Acquires the wake lock 1 IoCs

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kututufehogi.siva
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.kututufehogi.siva
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.kututufehogi.siva
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.kututufehogi.siva

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.kututufehogi.siva
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.kututufehogi.siva
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.kututufehogi.siva
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.kututufehogi.siva

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.kututufehogi.siva
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.kututufehogi.siva

description ioc process

File opened for read /proc/cpuinfo com.kututufehogi.siva
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.kututufehogi.siva

description ioc process

File opened for read /proc/meminfo com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kututufehogi.siva

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kututufehogi.siva

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kututufehogi.siva

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.kututufehogi.siva

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.kututufehogi.siva

description	ioc	process
File opened for read	/proc/cpuinfo	com.kututufehogi.siva

description	ioc	process
File opened for read	/proc/meminfo	com.kututufehogi.siva

com.kututufehogi.siva
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kututufehogi.siva/no_backup/androidx.work.workdb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.kututufehogi.siva/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
0d469e13fc169716258c2576669c1d41

SHA1
0c37e7c0450392e9050bfb479ffca44f0123b03f

SHA256
2c450b17d5e89ccdd82c4afc4edbf5c44d4f196ef6e56ccebaa4477fc183a646

SHA512
0ab8633075bd9ff90b67d64aeccadb2e70a71b330e28fa83800d3c566d21b09fc7851ce11774b0dea0cc9ecdea5957f4dea11ac4ae9c7d9cf6016d8fc708d6c2

Download Submit
/data/data/com.kututufehogi.siva/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.kututufehogi.siva/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
959d9988759bbef66e34731f645235fc

SHA1
615b5599bdd73639b2476d1709cdff61ca478879

SHA256
661a34725fff46c531f3ce867e9ff7c193547d1cac59d4a66c8ea095f79b8b29

SHA512
ccaec5464e6f45173cce8f0548fd65aa3d4554286e9283f7d3742f42d12d5ce97ca60b82665ab6c79e42450197ac744211c4b0f42e66661c3e8c3751b481df4d

Download Submit
/data/data/com.kututufehogi.siva/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
974a728c1fac94c880ac2e57aa833a52

SHA1
049e1a045f11c9964eb214c5f785d65c31818983

SHA256
395b4b5a1e14c99f5cfb9eeb17246cc18ba67e74868ca8671b85b2d99b9e3da7

SHA512
6dfb9d5d3a9c96bf71e9413779ba7f911de567bcc5a5d7d7a79d12031db0f8e03b67ccd31085e08433649c5cf14f7598f37a28d0a5d8a093a7dd04c9b326acea

Download Submit
/data/data/com.kututufehogi.siva/no_backup/androidx.work.workdb-wal
Filesize
173KB

MD5
de140603bce03ed5cbbf8dbf310788b3

SHA1
b58c613490a33bb3ff048a019b29f72c94c32108

SHA256
c942b6166db8251a43e9aaf9057e7a80a1f017ed153436c4f3e3e185ad9e7f60

SHA512
8177722b9092f8346d9da4b1578cb2ffbd25e595b15558ce97010018489a9f44185d77b0fbfa5ff46231b55793c367d6c5cb548b498a0b5c18231592a96c60cc

Download Submit