hook | 49b1a094b7abe2f2d0202cfc3023535d43b8450cf08e19647bb7127f22e5d739

Analysis

max time kernel
72s
max time network
156s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
24-01-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49b1a094b7abe2f2d0202cfc3023535d43b8450cf08e19647bb7127f22e5d739.apk
Size

1.1MB
MD5

5f90d143a5de2341d18fc09d6977e27d
SHA1

0b3c79eaceb6fcedc61d7281bc08666c333c69b5
SHA256

49b1a094b7abe2f2d0202cfc3023535d43b8450cf08e19647bb7127f22e5d739
SHA512

bcb30c4ab6947bf31fe183e8d3cf234b076b4bbc28b34d9d68dc31971796fed9957bde69460c10ea4881a08c683cb9d26267ba9fa2689499af301c9157d314ba
SSDEEP

24576:zS4ik8yDvJ+iEGfXex8Ds1zoQQoip/ojyMxg/XvZKy5:zDR8yDQiE4eXj+/XMxg/Yy5

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.puvovojegodeyu.pugi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.puvovojegodeyu.pugi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.puvovojegodeyu.pugi

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.puvovojegodeyu.pugi

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.puvovojegodeyu.pugi

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.puvovojegodeyu.pugi

com.puvovojegodeyu.pugi
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4595

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.puvovojegodeyu.pugi/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.puvovojegodeyu.pugi/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
eb65e5b975917dcbed1a505ec59d6ddc

SHA1
2e2190a24b2367df40c765bac3f0a66c02aefbee

SHA256
a43382142eb7abcdcec9f864acbf82c422a8905c7aafccdd5ebf36069f8f7418

SHA512
8de0cee727993aa2905f91111025bdba82f0b551ab6d783f7a9194d1ffa5aeb897a14a3c80b501c8707d28e842115ccf8c4733784cceaca9703f548f1ccec76f

Download Submit
/data/user/0/com.puvovojegodeyu.pugi/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.puvovojegodeyu.pugi/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ae990a5dabd3e5d103ed8711ad343de0

SHA1
acaab99cbfd3c22782ab9793343a6219987a283f

SHA256
cd64321fec17028c15eb5001062e0358d2b39b9a55037a0b6deb7b3158be6398

SHA512
1e9be7dd24681a592434991aad4508eb1f58620ffeaa25b94517689c7a20eb24d46f4948c886c3f91783f1e24c8eb2cc382a9ef8739221b5e50d41b148c00e26

Download Submit
/data/user/0/com.puvovojegodeyu.pugi/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
dd8c326ca3cfe924454e934d4bf56f03

SHA1
d22160b9d66a07455169fe86c1b4f14be79ca956

SHA256
0bd90242c67192992988fb7b639ce2f52c25a85e605307134e84a2f0ac9822ed

SHA512
e1201d6dac2bd09cb55e2f7c0dbf374761f65c9399936c6062151716582f2d21dc0e83586c96ba614111cabbe06bbe5f74997d103abd0147194570faa0ee56ca

Download Submit
/data/user/0/com.puvovojegodeyu.pugi/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
98fbf800f7f796706d9d88dc29de510b

SHA1
531b9fc0125b2157ea43918c2402dc5e21450fb7

SHA256
e53dcd93dac9d6a84f3515729e71e8ec8065acd9e0a13dbea9010fb81bef30be

SHA512
6308b94428047fc7fcc1d11c6dbeb0626f8d941d7776cc97903a8e975865ad1df3d91ce6dbe70c9465963fa010c04ffe086aa87dc20a951e0309826fcf28de1c

Download Submit