hook | 5789aeb0d77bd94cb024c2baeda436ee0361ecf68b474a8185a933b5dee000ce

Analysis

max time kernel
148s
max time network
154s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
19-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5789aeb0d77bd94cb024c2baeda436ee0361ecf68b474a8185a933b5dee000ce.apk
Size

1.9MB
MD5

4801b59592e9a335cef4a3e210f38c68
SHA1

089cb14e41feec7fcffa1ca934f15db33d5bae90
SHA256

5789aeb0d77bd94cb024c2baeda436ee0361ecf68b474a8185a933b5dee000ce
SHA512

23d052f51fb2fc48b7f5fd77f1f5d69a6ed1e0ddcf82c3ba74b0aa26bdacb38f6893c06eb4aa6b648a84a6e3ca1f977f2c4722831c89f67b386f3a2c7ecfc4d4
SSDEEP

49152:WEmKrjPT0dWF05dLMVTFdr4pstRMhE5cJ5nh2:JPP4dWWbMVTFdr4ePh5c2

Score

10^/10

hook banker infostealer rat stealth trojan

Malware Config

Extracted

Family

hook

http://94.177.106.48:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hello.bro.wroklations

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	hello.bro.wroklations

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4261	hello.bro.wroklations

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	hello.bro.wroklations

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hello.bro.wroklations

hello.bro.wroklations
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4261

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8e2443a58c264702ec512972073ee7e3

SHA1
cc284f07c9ccd5d3c5528a1c8573843d67b33465

SHA256
7d31a455d8cdcf82fc4509d57f977949ef1ae76986f31336f8dec97858823f27

SHA512
d854dae21b50b05069db309e4c624c6fb13cd888adfec033547be76913e7c64afcf2d08837dd1d0df6e5be76d6cfcce12fa029fefeb105d8e95e292ba6852adb

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
96c6833baabd904e69c3682d1909f7a4

SHA1
83da330a7f81ed87285d81dbe7f86d814a2fe1c1

SHA256
56002343e6e870a5315a0dc45da68d2b0f64e4f8b31f77a688011f84eb8f080d

SHA512
9a24af718b4e7167393491c67b5bd0bc8c79aae89886dd3280718421b05ede26b781f7206153c01958e87cf5666f93694c868a453a843ee2771f1eade05fe7da

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
30672ba5a79cddd1801d5ad6b0d19a7e

SHA1
a59952cb2c6773bca466e89805d7e08558f80adb

SHA256
0a5293034360babc0d3ffa692ed5d6fb35c7f491d7bc82a90b342a219569bbbc

SHA512
7fbb67c0e8107239747e161568718bf961512ef254ce6bec97418572b29696ccb474d4c1c706a48ded5fd3e506280bb759f25aa7788f1f8e9cdb98a344ca182e

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
7a04764f9638a13d89aa3cad837e3677

SHA1
f7ac76f19e6daeeb25691c18b65ebad6f989c72b

SHA256
21d0b7ebf416f14504e560293457e9b95efc7b44f1e8dce97df9d0d566b79fec

SHA512
3486cd14dfb8580626e00c2112139c5117cf59f06179072e5fd6b1e276d6bb985ccb4c63670b4b425256b9de27dac847b13939fca67a72f8050309b891ef761b

Download Submit