hook | 9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22

Analysis

max time kernel
151s
max time network
157s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
16/02/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22.apk
Size 1.5MB
Sample240216-mggddshb28
SHA256 9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22
MD5 a504db0104e555b252a3bf39d93fe93c
SHA1 6ca0d1bffa71b45e85d648d574de3fb50c938b65
SHA512 dd61f28d1d1031c5774d08902ea77cf3d6df1094d6e061ab3c3a3dbdc1a4e8d422a3a7bddbdd40d6f769d202d1bc23a167ba426a29c3bae16a88b60d8bcba08f
SSDEEP 24576:yhq31VixO0eJywY82y8XVwuUYwsq0eqciitOkTHDfWMvkBFjyAMg/lnq:Q6Ae4JJykwIeTiitOGj+MvkCAMg/E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://hsms1.m0rph3us.com; http://hsms1.mi1kyway.com
http://hsms1.m0rph3us.com

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4989

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 afee0f3efb4ccdec6343c89143ad5e40f4d7d852f21402c5cd6862fee8a20f05
MD5 bff57a420a1d4f53a362d8237012afb3
SHA1 48798ab1376eb8c4b1b7888d7a096bc763db130f
SHA512 2ed26674d86769e97e678284183b8cec16f1c01a09b9ae231b6c951f401219a7c99cfb0f5daca64ae09eed389aced03ad2767780dc5077efd7498ca6390f9af1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 f9e0445455257b2532add4087587beb83e8cfd608acbd96fa1e5c8ff82e9cde7
MD5 85d78aaf98b3306b95b6448066476d33
SHA1 710c3f88e7ffa3c76f7eb86ab0fd21c621a13c4f
SHA512 7fff12739c49c6a184fd6050aa61c605f9ef21d5d27e421fd407210007fff05803f2dd79a17f6c4c1c6f3927caecb078bb8ed1b281fecfcb82a1f6bfca9d85d3
SSDEEP 6:KWd4+kW9FZdrlOERX4PBX4ogLugMBX4suuK+/Maf6xgxGbgwEiOw2:KWdiQzdTRmBEyPbP/Mq6xgxGbgjiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 c927396e2aef90802817c0dc71a35badbf2ee12b9d2489bcda7dbcf272e89829
MD5 65e0db0b752d795b62ccf9250e712e2a
SHA1 f5374e54bae8190facbbbad788db683d5e49e3d6
SHA512 0de939dc57cb84e8be48f81dc24b37e81c7f830a792e9679daa5ca51b3728ff81dd69a69e7821247d14cc30406ed0c9a7aed2775a4581f8aece741dab623f5e0
SSDEEP 48:EPAMYg1KAZktWdACDAVCKAuFhABPAUUKAzBnAMYjh1A7Y1KAd6e:WYsZMBpYp1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads