hook | 6458c39b417c7d61028c5187b083c92fd74a77694cd0958b7f48249c9ff1297b

Analysis

max time kernel
43s
max time network
152s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
24-01-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6458c39b417c7d61028c5187b083c92fd74a77694cd0958b7f48249c9ff1297b.apk
Size

1.5MB
MD5

2d394b49050f9d5280a010774301b46e
SHA1

f786cbbdadc23884dc4d1def78870611b0248ca8
SHA256

6458c39b417c7d61028c5187b083c92fd74a77694cd0958b7f48249c9ff1297b
SHA512

77f49f62ea63da3a2abab6a912118ca3d49830e73fb9a9fce60144c7f51c6ac3407a21cada7bd6f825d6efccd37260af55392ee4f70ebfdc5e83d79c46555ae8
SSDEEP

24576:Hw/7W29sPCKOvEeyxkYG2PBaPnsiYB41oIDYUvsp6yqymn9+uZvaoqiLGbeg/lbU:HwTWMsPCHwx1TpaEwvvnqe9zYoCbeg/+

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://135.181.168.156; http://135.181.168.156

http://135.181.168.156

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4251

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
0ba53481eb6acf8e2cf7f452b2e2fff2

SHA1
eba9c06b0a40a9b84fffac48ceea9b0788b3d892

SHA256
bb3995411b8068cca56eecfeb769296d19eab97b67d7d0d5a61ce52ece177194

SHA512
52c6992d84e0e80366f71addff974eb89b08174f915755f0d11e454bb56cbfe2627cc9de683e5ff4a8e9b09de2062b0dfdfab955d66c31160a07c8b4249ba42f

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f4893c0f2a30d77e803897906d69dff8

SHA1
118d86c326b31685a242316a473c57ae5f5730ba

SHA256
beedc04749c48b7d9e50d85eb3af60297dc674ab31dae90f84ba60d997726ea6

SHA512
59c9fcb9ace2be16ec7d6905d17c58018142423749938c6220959b93eeae086381a9519ede98ff7d5b97ec34fa2e4191090d3395371173b8638dcd7f52fdd308

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
a9b5d73712a4e44310d519ea954c2d60

SHA1
cf9102a3aa8fa4b468b079e787d136d722221c7d

SHA256
4e21603883c8d8dba51169dc5eb129e3abb4edac2d163288a3317fe26dd61fb8

SHA512
6b034ba4897894de13bb73943c58936a6ad4bb9cb2028dc74a082c67bd7936b9954db3b992ab0452b8cc4707330b1d06264af61982f2ac98b6abb5d3f607b981

Download Submit