hook | 96d9021b3f63da9378e9208b640ebb670906718012db902a400ba101dbdbd3b6

Analysis

max time kernel
3403049s
max time network
156s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
02/01/2024, 15:38

Target

96d9021b3f63da9378e9208b640ebb670906718012db902a400ba101dbdbd3b6.apk
Size

1.2MB
MD5

7c466ce81527867aa98ff5f187e54bc4
SHA1

e394e2a93af3e746bbd87f2db3ecabf68ee45ba6
SHA256

96d9021b3f63da9378e9208b640ebb670906718012db902a400ba101dbdbd3b6
SHA512

dc084d7338b41c95b72fbd44c70f2c4dfd3864297eab96d173f58cf3b71d9bff9c068a971686cae8257d560143dd50afac3e1afcd807a5025eacc2631936cbeb
SSDEEP

12288:CUZFO7Nq1wryobO83ubYZtsZcoc1IkcxxhtS/7iwbO+yq39DCn0yKLRrp8cWxgii:C6YqL83ublicCy+yq3kn0yIRrp83Gh

Score

10^/10

Family

hook

http://173.254.235.53:3434

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4995