hook | 9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22

Analysis

max time kernel
42s
max time network
154s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
16-02-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22.apk
Size

1.5MB
MD5

a504db0104e555b252a3bf39d93fe93c
SHA1

6ca0d1bffa71b45e85d648d574de3fb50c938b65
SHA256

9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22
SHA512

dd61f28d1d1031c5774d08902ea77cf3d6df1094d6e061ab3c3a3dbdc1a4e8d422a3a7bddbdd40d6f769d202d1bc23a167ba426a29c3bae16a88b60d8bcba08f
SSDEEP

24576:yhq31VixO0eJywY82y8XVwuUYwsq0eqciitOkTHDfWMvkBFjyAMg/lnq:Q6Ae4JJykwIeTiitOGj+MvkCAMg/E

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://hsms1.m0rph3us.com; http://hsms1.mi1kyway.com

http://hsms1.m0rph3us.com

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4249

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ac97bf9741ad65aeae24ea9f4bc27b21

SHA1
2169a2d538375801b977e0a2a89bbe81c3f0e276

SHA256
007b58fc48e6f7e5b1c8c1d6d987fad6ceb9da593d3738c6050d029d1a33ab73

SHA512
c8cdb6cde789e9c2fdc7e84dcb606ba36df8355befa8f402744c5e14d87d36915a34dbee01e75ce20f15efe4f78c74503a2026697913576440a5c9d007e681f8

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
134bbe85b9e36510dae4aa19b4a2fb69

SHA1
7578ade227b0fd311d17412f542fdf6e389ba95e

SHA256
ca8e693ae24e1da7358b1d66880121debf4920d38f49427b6e92f831f8848335

SHA512
6325a7c6b2a16617fbd96b6a7457b8e996269bc2a99f379594817c2e506adc330aeb9ff4132966012a3d1fb5764f389c9ff177b6645d410c37ff9848afec560c

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ac1484b506dc814dc76f27f552368e43

SHA1
7c7dc5e9d8880dcd0766c99776f6da738fa9d5ae

SHA256
d4e8b28cf8003c854c29451387f963083282c386ae48d96b8ccea25c37a8edad

SHA512
c1cbf855e5c7b9c06a8146c907c6238c68c50d3bb51351104814d01a1dd92ed78594cecfde93a30c703b026d5e1bf73bceb4f3b855248c854d80241f248c362f

Download Submit