hook | 9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22

Analysis

max time kernel
151s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
16-02-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22.apk
Size

1.5MB
MD5

a504db0104e555b252a3bf39d93fe93c
SHA1

6ca0d1bffa71b45e85d648d574de3fb50c938b65
SHA256

9d1ba69e8482de84f1315b07f00b722c59170fa9b73029cb2b88b79809011f22
SHA512

dd61f28d1d1031c5774d08902ea77cf3d6df1094d6e061ab3c3a3dbdc1a4e8d422a3a7bddbdd40d6f769d202d1bc23a167ba426a29c3bae16a88b60d8bcba08f
SSDEEP

24576:yhq31VixO0eJywY82y8XVwuUYwsq0eqciitOkTHDfWMvkBFjyAMg/lnq:Q6Ae4JJykwIeTiitOGj+MvkCAMg/E

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://hsms1.m0rph3us.com; http://hsms1.mi1kyway.com

http://hsms1.m0rph3us.com

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4626

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
558f6db96039e4c821408d21fab1a392

SHA1
fe9b229915be6654bba906ed544e819e67a1d42d

SHA256
f6aafd78ca31ca0cbb14f0b7a73eb4b3866826b01a07be0c7a90bf67d60ecbb0

SHA512
66e8e7651cc5aa7902b26610fccd6c21791f400d013ea893de6f85133444ba06657b4c1651642d07996cc9049e27b1e8ec3e4b56adc8d342df2cd2c4f856afb1

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
420bc54b625dac2830a00e41636db49d

SHA1
3e5e17070c11c70897ca4926332aa682bfe591d0

SHA256
59a1dfc008d9a11065a18743f6b68ba4c6fbf316c885a82190b9a7d4f1122683

SHA512
da4c92f2350308eae4ed4bd156363a783d9bc7a4238203e28da04ab81a300775ba4dc1c04317eccb1aa7610270d0aa42d8a39b92e4ae2be125c286260f7fb2f8

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
567f01a37410aa809a5508a71fb57123

SHA1
9d77de36f0d4936cb797c6771a1faf8745b6f976

SHA256
b87a1a7e5259954124c8e377a45bea6defa8b26d5c741e4b3c0297dec77376e3

SHA512
8015428502cbe3d5fb78e0f9e8258053a33cbfed901b30240847cc2068960771dc7b7afdf4bf98f5de3be6a367f6f409d9af8afa3281472247c2386a4f132ff8

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
4d51f8e0a79b57af76dc37948aabacf8

SHA1
717d94678b40b9dea3b64ae9b6b21e6a18ca2cea

SHA256
9c61da7711744634999b9bd63092260d43dfbb14ff3d79e5459576b131ff981d

SHA512
3ecd35daf805d50ad472975eb167689580cee1c4f5e3574d3ad8498e0bc4c08a5d606a40c08ff9aad238850e96f4c9831e0f56ce9a78346ec5570464db89c803

Download Submit