hook | 5084b7d04053dee696cf2c0774b9ce2862fc52d94cb91a817e6e2519199a61d5

Analysis

max time kernel
150s
max time network
132s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24-01-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5084b7d04053dee696cf2c0774b9ce2862fc52d94cb91a817e6e2519199a61d5.apk
Size

1.1MB
MD5

fdf405da2e5ea9d17bbd80c7135ff126
SHA1

88df35260863316572f7c1f4954715153e3b572d
SHA256

5084b7d04053dee696cf2c0774b9ce2862fc52d94cb91a817e6e2519199a61d5
SHA512

94e581eb2d9d09ad5d228218559f8fa8e2e2831f1998887fe242fa341777e5bb25fd5446836d4e4c54b25b6b2ca8c2d4dea5aad9c47d726246141f750c97ce57
SSDEEP

24576:h0gZareG8LKsstERHb1E8hsCDxRkpT2OU/o6yeng/8vpL:FMrH8W5texE85eT2z/Ceng/qL

Score

10^/10

hook infostealer rat trojan

Malware Config

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wapotijafobi.jano
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.wapotijafobi.jano
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.wapotijafobi.jano

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.wapotijafobi.jano

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.wapotijafobi.jano

Reads information about phone network operator.

com.wapotijafobi.jano
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4262

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c5517d6a4ba2cd518405e82d292ac26f

SHA1
9fa8fbdf49210c901894d3e3a4ef1d4fe0220d1e

SHA256
1cc768ebd10e3f233bce88fd1c219669d939b7692464af4029fc81e6427fe6be

SHA512
72b04cb158d47b5d2f6675627e48d343b4582d8c71848f1c2b115d84c6c7cb4c9d2652df2d054f215c65fb9d623d116bd5d43d96983e281524617c3e6294e8f0

Download Submit
/data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
74ed88d0135021db3dd4d2360d784f0e

SHA1
101cf49696218194d101f8346d93ff8848de1396

SHA256
560f515fc12859a0fcac9d9401b3d0b130a3f6c0c711506d64764d65c046fa5a

SHA512
6b568d9b27b7a312c78bd63f78ef004bc04fb6b5806f4565a977084cc6f1968f6badb5c7ed2db492b98b7cd0518a55fd0e01d3449522a859e0a9e852786afab3

Download Submit
/data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
7a65e95fd3db8c379804ef08d9915d34

SHA1
ac6ad306b8286fc1518349c62c1900c2f3aa231f

SHA256
5b153a3a0e1ac18e013daf9cc0bdeaf3a69601425bc942847e9db6962d0cac80

SHA512
962b00d3390cb262c0db53933277f3ba88b2c849028ab4382927051217c0b667168c2926a9069ebbd3076abccaa5f42f03381da512b538002158f1494f4793eb

Download Submit
/data/data/com.wapotijafobi.jano/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b557b82d296037ce8a77f1649aff6ef3

SHA1
a287f984c042f73e74747938f1c11651b1b7154f

SHA256
94099bf32888e7cc82dd18b8fc7ffd6b4f856bdfe30e18c6882371bcd4c94903

SHA512
f45dc071cb2efc5a964d39fd2064f2fa50eb8d20b68f90bae35032943fcc181cced89f1f6de90236a7983e25143d659cdf64f621611191616fb14048e3cd9da3

Download Submit