hook | 5687b460c2da0dfe925a549c595dd4523a92d2f41a4b74095990de35bce25784

Analysis

max time kernel
72s
max time network
186s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
23-06-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5687b460c2da0dfe925a549c595dd4523a92d2f41a4b74095990de35bce25784.apk
Size

2.9MB
MD5

09b45e8390d1717a4b8b507031fc56d1
SHA1

a34a7b69fee1e5a0c74a955070753ef553272961
SHA256

5687b460c2da0dfe925a549c595dd4523a92d2f41a4b74095990de35bce25784
SHA512

7dade2ad54abc85943b919b78b5675084ce987594a7733ad8130603eedafcfd314d48a1d91638d585c4585160d34032dc7718bdc30898277a55fd152ae308bc6
SSDEEP

49152:lU5O8gi0yfz0HuNDajlN67M0dSvBWZhRGm+VT5Q50qs0ClXeHpg/Mg:laOOfYHupS67MS9ZhRGlQ5X4X8g

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Processes:

com.kututufehogi.siva

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kututufehogi.siva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kututufehogi.siva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.kututufehogi.siva

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.kututufehogi.siva
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.kututufehogi.siva
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Acquires the wake lock 1 IoCs

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kututufehogi.siva
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.kututufehogi.siva
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.kututufehogi.siva
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.kututufehogi.siva

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.kututufehogi.siva
Reads information about phone network operator. 1 TTPs
discovery

T1422
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

com.kututufehogi.siva

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.kututufehogi.siva
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.kututufehogi.siva

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.kututufehogi.siva
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.kututufehogi.siva

description ioc process

File opened for read /proc/cpuinfo com.kututufehogi.siva
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.kututufehogi.siva

description ioc process

File opened for read /proc/meminfo com.kututufehogi.siva

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kututufehogi.siva

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kututufehogi.siva

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kututufehogi.siva

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kututufehogi.siva

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.kututufehogi.siva

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.kututufehogi.siva

description	ioc	process
File opened for read	/proc/cpuinfo	com.kututufehogi.siva

description	ioc	process
File opened for read	/proc/meminfo	com.kututufehogi.siva

com.kututufehogi.siva
1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4469

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kututufehogi.siva/no_backup/androidx.work.workdb
Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.kututufehogi.siva/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
9f96324f4fe42034455f1631c9a3458f

SHA1
d18b220e83d43d5b0e75a2f3d4df005cde2a598c

SHA256
056f3d94e53e63a99da36e23ac38aed22ecaacb53ccf5ae8f9df59a8d1371ee0

SHA512
576cf9e81affb0110d09a5842fc0c5a01b8e196820def17a9a30002eac18eec3631111c37117ee1c9361c0cccd34507a3ac834901c170ac07e72dfb7a8264ccb

Download Submit
/data/user/0/com.kututufehogi.siva/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.kututufehogi.siva/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
6d023c53e8bf2e383978d2dbc9b5f216

SHA1
c73f424fd86951f70e4c0c12b17c0795160d59b7

SHA256
ad495062ca937432aa223f83f467e49efbdb91cf633297a0b1ebdc337ee5c63e

SHA512
676d26ce3324dab9ab4e4de928e9ba694f6f95aa93818b8b3940454b336b4617a38f4949f4ac9a0da9dc6110bf54e8c3a5704a4fd815d1e763e9a1445e2be576

Download Submit
/data/user/0/com.kututufehogi.siva/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
b275f32422236c4e81c6bcde211bedc5

SHA1
a1bd3bb1a295d0f48a82bc1fcbe4a7aced036d81

SHA256
23179c8cd74157366d722b5abace7b8d6eb22fa1976f05872f8d19f1bad18dd9

SHA512
f8146088262b3d03d3dde2f72c799a4f648ba1df7b6b20baaee3dfd23243ba8641155fbda1becd4d03516e4a4cc4c7e7f3a38fabb963b9dbce67434d23c6c652

Download Submit
/data/user/0/com.kututufehogi.siva/no_backup/androidx.work.workdb-wal
Filesize
173KB

MD5
bc0f2241f4e80a34778e1e28e7196c57

SHA1
75e0765b09dfdb8d622c5a614d40340dbaf30c50

SHA256
4432ad16748ff13185dfe17024152d53a1a5b05718f0ac053f562df2bed15e7c

SHA512
2bff309c23ff8efcdbb1150f3b6df46076806a7d774b5bad0116c9489b6050f0841189de8154850bf19bcd9c59d59c37c57baf4b86116c68a84f184194ece94e

Download Submit