YAHFA

Reported Context (3)

The engine is built on two well-known open-source frameworks: YAHFA, which replaces Java methods, and Dobby, which hooks native functions. Hirudo Android Banking RAT Replaces Banking Apps With Patched Copies
ThreatFabric found that the malicious copy of a banking app retains almost all of the original app’s code, but loads a hooking engine built on the open-source frameworks YAHFA and Dobby. Hirudo Android Malware Replaces Banking Apps to Evade Security Checks
and use that as an input for establishing hooks in Android runtime (ART) using a custom version of the YAHFA framework. The way that the hooking works is that ALIEN contains an embedded DEX file which is loaded Cisco Talos Details How Intellexa’s ALIEN and PREDATOR Spyware Target Android

CVE (5)

Malware (3)

MITRE ATT&CK (7)

Vendors (3)

Products (8)

Tools (4)

Industries (1)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.