hook | 6fd741480791e7cdf99881379603ab5a0b3dd840c6298e8e424a37dbcac99602

Analysis

max time kernel
150s
max time network
151s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
08-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fd741480791e7cdf99881379603ab5a0b3dd840c6298e8e424a37dbcac99602.apk
Size

1.2MB
MD5

6f3dba242c2264acee7d8628c8401838
SHA1

27f923ef644b588e0bdfa481e76454adafb9136e
SHA256

6fd741480791e7cdf99881379603ab5a0b3dd840c6298e8e424a37dbcac99602
SHA512

b60f5059a898ef17fc79321702ea1cc73ac746b4354b09e887f12ab0050c071d7561b513cfc56faf97254032f678b32b216a9e50ace01cc9615d7dd72180d31f
SSDEEP

24576:Vc671ECkx1Mp8dr2m6CbqkZ8Kesb6z4ke+sUMCojIZ5g/5yLg:Cikx1g8df2kZ8oWEdAJZ5g/4g

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dugibanuwewi.bere
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dugibanuwewi.bere
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dugibanuwewi.bere

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dugibanuwewi.bere

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dugibanuwewi.bere

com.dugibanuwewi.bere
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dugibanuwewi.bere/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.dugibanuwewi.bere/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
9bed1a2b4fed106b37c4603706b643af

SHA1
f88b1ee6c91836ac7ae8392d2e0bc782473f5819

SHA256
e305c376357895b6e7c4aac86b19c5383280cc6ffedb4c5e6547f06b3e07c00f

SHA512
9be2410a8aa329d4501dcd79179c54656d9ca38683068be803853f2f7c0c6647f8da75df6fd0838cf4d737a660f3308165de1eb13b7284bed6a7209f1e679563

Download Submit
/data/data/com.dugibanuwewi.bere/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.dugibanuwewi.bere/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
a16fadd956e7269c0cc7a0adbec92f40

SHA1
541bf94ed485f8176020913ccd5e35aed5aa5ec9

SHA256
5de1fcce4bb9948de099be122e7dfd3c721e35e55b2ad009f7b16f228e70cf4c

SHA512
2ff8f82b1690715a85ad2dbb04d9ce5bb4175828daa1ba7223fe89faea439a416f48384d6146ec16c27ccc43a582a432ecd916ffe12805d9276666864619661e

Download Submit
/data/data/com.dugibanuwewi.bere/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
ac5c4039903c90c020314e9102d9fec1

SHA1
5681bb6f1893f46427203559f121cfc05bbee434

SHA256
48966586add3eaeca7fc6b52bbf1bd615b5d03d93b3d36d70fe4717223faacfe

SHA512
6d1c150fe9638f11d3592621791f33a39e773dcec5b066bd211104364441240c2d37ed2849d1641cd03315e86a7d3441870570e187d59f1194270703aa0ee540

Download Submit
/data/data/com.dugibanuwewi.bere/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
6702c83e0e5058159437087c2728cee3

SHA1
b59f9dc27243d496cc847943e60f0e8c413f630a

SHA256
bedd3d20ea916e47eee78a2af3d77b3f0f1f00adbd076bc1ca5f8915407cb3c0

SHA512
0b07b3cadc2c93ffaae22de87500656a0a514a7a2e5c12fc6239f1a62f396458dc7d02284dfe07b1f7a878387b006293fe3e1fc3837d39f26a51cd409c49e42a

Download Submit