hook | 6458c39b417c7d61028c5187b083c92fd74a77694cd0958b7f48249c9ff1297b

Analysis

max time kernel
153s
max time network
157s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
24-01-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6458c39b417c7d61028c5187b083c92fd74a77694cd0958b7f48249c9ff1297b.apk
Size

1.5MB
MD5

2d394b49050f9d5280a010774301b46e
SHA1

f786cbbdadc23884dc4d1def78870611b0248ca8
SHA256

6458c39b417c7d61028c5187b083c92fd74a77694cd0958b7f48249c9ff1297b
SHA512

77f49f62ea63da3a2abab6a912118ca3d49830e73fb9a9fce60144c7f51c6ac3407a21cada7bd6f825d6efccd37260af55392ee4f70ebfdc5e83d79c46555ae8
SSDEEP

24576:Hw/7W29sPCKOvEeyxkYG2PBaPnsiYB41oIDYUvsp6yqymn9+uZvaoqiLGbeg/lbU:HwTWMsPCHwx1TpaEwvvnqe9zYoCbeg/+

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://135.181.168.156; http://135.181.168.156

http://135.181.168.156

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4989

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
fc04660922838590b121927205f47598

SHA1
daa7c3aeb03934330994a23561c95a34ad2bc83c

SHA256
83befafa8380d1af64b82cbe9732b204b68420d8af11e45d793bc0acb8bc7dfb

SHA512
31dc76d8c903104267b2e2f6beb2fd6f5dfe7e945dd0caae4bf62311840e7c859b3063128b3811d140464804165c5846250fe3b16b3ac1094b7b1541976400d4

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
c96dcc73e8316c0c7e717d8c6e7b3994

SHA1
38278c7a03f6789f9893e0e5b24c446d5277a8be

SHA256
fe363b7eb8481d2f7f59908bb0f60d706318bf668e64b49654f12916780b3b21

SHA512
f0849870dd6cb6ec006ac870b58cfa082011806901f8ca0d83f8e9727be118c80bbdabc6631a3e88f88e61188efc26acd493592684c1167bea776af8b31f5b84

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b03dda0541c27ee8546df628b31fab96

SHA1
be9970bce8ee7a4b7054d9b224e968a29fc0645a

SHA256
f644f3c30bc1e9048e631c7d8007aa346f8e341bfa45e9b69b793e89942f2ce8

SHA512
331054003d69625ca8e7a97e13f64cb1d253713be3fc6c6edc4e8247db5372f6a41b1026acb93559cc9dd12fb0aac71bd3bd0c1c09c08346bd254eba6bf048eb

Download Submit