hook | 0ef21ffb179d61c9aecb291a8e4c88f023346377b49993465367d2d0aa9beeb5

Analysis

max time kernel
157s
max time network
167s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
09-02-2024 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ef21ffb179d61c9aecb291a8e4c88f023346377b49993465367d2d0aa9beeb5.apk
Size

1.2MB
MD5

4344abaeb4717d271b826a4acd7dd464
SHA1

213390187ecdbc6114ce20af02f1107f50cf5139
SHA256

0ef21ffb179d61c9aecb291a8e4c88f023346377b49993465367d2d0aa9beeb5
SHA512

3f8aaad32aaee2788d243fb1a51032990b7480b35a31e88f41463f4c7cee896c395febc72b57092614304f8eb9e6aab076166f17c827ffe6a093c53fbce90d6a
SSDEEP

24576:/cr/pUPpuzhiXD0zJMc9oP3bz/+SKAFwquTqXmLOMkFhpqHhJgSkv:y2PpohA0VMcG3nKhq1wd4UhJgSW

Score

10^/10

hook banker infostealer rat trojan

Malware Config

Extracted

Family

hook

http://93.123.39.235:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4589

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
b0168624c1d47970c58724cb1f43ceaa

SHA1
01b8e9e77f6910c4a60ce68065a98cebb89fad29

SHA256
6309401ef7fbd6480b13d9e7c4232ae1d8614a0f9dad32e5e7955cc842dad343

SHA512
c80fb8eb97a15ab640ab1c3cfba5dc686ba4bdeef4047a97298bcadbb1179c75daa93ffa193ff6e2713b87f695c6b9eed87eda64677f099f37160c2e80232002

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
9199360acd64cc2147c237437750ce00

SHA1
9f43f28b76e5e2c37ea3db56cd1a1726628bde50

SHA256
ee67b3d48766f57e88a958c4bb989696b0f50d7c70556e4063517ef652a4719b

SHA512
9879af996225a89a9e3f2290de8c007d29932120fcf0f3c69f1b9ef3fbdd139b95c7908630b75e36ac5888f580ac0feca77d69254b692ad49659c3a4fa0dbeaa

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
45fef25efbdb1b3827c0eea2da4aeb59

SHA1
1ffdb986ed1b9b1b1c87b4ae599655dcba6e29af

SHA256
07cf1e26930888e0acf2475736188abb0406a83f3eb60433aad4f328b141af10

SHA512
a69f5959334e5bde29f4687bd7acfe6bb4210aceb6c85cc10862de6c6ca8fe8e5898947b3159a60f08bc30b9c4d014bc303e81c67849344f4b7024cfcca3a7bd

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
e9231367a0c63f9571db2958894ba8bc

SHA1
516b93ede548cae3fed518c7429b054e85a91cc7

SHA256
47ea02bd25f7f79082f67653c34f21f718e8f0c851c0e6f43744d3d06d19c0a6

SHA512
617d4f9a31bb5bc3e394cb0d7b943eb8d474d4a47e92b93b53188c273465ea9d361a3408a04de18faeb6835f36159b9370b9262334ab9dcba819732df534c3e2

Download Submit