hook | 4e4095098376a1f4d6fda6a5047519a252d27853a3cf4def5c6e731a21592cdb

Analysis

max time kernel
150s
max time network
160s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
09/02/2024, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e4095098376a1f4d6fda6a5047519a252d27853a3cf4def5c6e731a21592cdb.apk
Size 1.1MB
Sample240209-kv19lsbf84
SHA256 4e4095098376a1f4d6fda6a5047519a252d27853a3cf4def5c6e731a21592cdb
MD5 5cfd5c4c94f7ddede2ef937bbe5d7722
SHA1 60d7e235c38c205d377d7d2e477a981c0629a221
SHA512 f1cc7759849cbf300d885ae618f4771cf65af5ee34396fd831c62179c5a814f6acee73de39e0a26f075083b63a8660d713a18c5ab53781dad03eaa74a8ddbf38
SSDEEP 24576:KW4GI8JXs+C85Vv6S6pKZTY//db/C+/IBwjojy/2Pg/+e95:KgFXsX85Vv6S6pcTY/1jC+YwjXOPg/z5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5001

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b2f310eedf92f6fc6ff340ad02f2a89ac7ef0a4549965cdec55e510f235aa71b
MD5 7083e0398e0fdfff1a9f3e97b133b609
SHA1 09bfaf5952ba2eb004e0fcde4fd47d23c8af5ba1
SHA512 a7c3b7eaf00591c54ac9591f127e5b7ae09765bae479e6894d694710fc8dda4c19df4d53b1a570c4ee3d7b8c955e30fdfd109772c66ee30f642d8856b4ae2cfe
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 52ea903c0017b412cdfd4f6ea42a4c23867aa1f38e2ff06f2eb24110bb5f181f
MD5 0bead0291223a16d0f2762d91748208b
SHA1 823490af95276328b554d3dc767e6d1b8e93cb0e
SHA512 1360c62df1dd7c4d690ea9609842a16776dd65ee097ef1b1721d979531bac3a6a28b165aa279b2fbb0d8c0ad7e1147db1d49bf14188c008dcc1d462aac5430e6
SSDEEP 6:KyAl7xVl9FZdrlOERX4PBX4ogLugMBX4suuK+/pl6Ow2:K7xVTzdTRmBEyPbP/pl6Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 9d6c9b4b8685c0b4d502e50943a7521464fd5466f35b3e05258246e7908ea433
MD5 98c42fae3f9b55ed9a91d5a230bcd94c
SHA1 0d360c3e4d25a64355eb14c8cafe8c82b691d550
SHA512 d972b417846461546dd3f80f5681213c35bea295561bea6ec8c3e838b94dac82e5452d15f679af5e4e8540bd2d3472e2a3a71e00ab4daae5f3e7f040a89b4979
SSDEEP 96:FkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPqp9d:GVdjnHt9Mpf8UzS5+TD8q0E5qx
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 148KB
SHA256 5d634656cb55b7d7bde98e2ff51290b0b604869ac6e454b3e365c2b424d94f46
MD5 673aec8d10793fd1b1e08b29b554f2c7
SHA1 f9f819256c2104af9d388a0ead964f91aa0e7712
SHA512 ed69f7d30378d80dd950c4171cc318f515b9fb666d0fd4989c37d43e5afd3fdfd609e1b5981c91eea0a5486098804fbc94d4210b3487c0da6f01d66081332182
SSDEEP 12:FLkZ/HOvDghpPMXrfqqS1y/HOv6V0jF/1l0phpg/HOvbF/lwhpg/HOv+ku1y/HOG:FzvoYf2vljB0zv1+v+dv4Ovv/vvjvw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads