hook | 5789aeb0d77bd94cb024c2baeda436ee0361ecf68b474a8185a933b5dee000ce

Analysis

max time kernel
158s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
19-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5789aeb0d77bd94cb024c2baeda436ee0361ecf68b474a8185a933b5dee000ce.apk
Size

1.9MB
MD5

4801b59592e9a335cef4a3e210f38c68
SHA1

089cb14e41feec7fcffa1ca934f15db33d5bae90
SHA256

5789aeb0d77bd94cb024c2baeda436ee0361ecf68b474a8185a933b5dee000ce
SHA512

23d052f51fb2fc48b7f5fd77f1f5d69a6ed1e0ddcf82c3ba74b0aa26bdacb38f6893c06eb4aa6b648a84a6e3ca1f977f2c4722831c89f67b386f3a2c7ecfc4d4
SSDEEP

49152:WEmKrjPT0dWF05dLMVTFdr4pstRMhE5cJ5nh2:JPP4dWWbMVTFdr4ePh5c2

Score

10^/10

hook infostealer rat stealth trojan

Malware Config

Extracted

Family

hook

http://94.177.106.48:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hello.bro.wroklations

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4519	hello.bro.wroklations

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	hello.bro.wroklations

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hello.bro.wroklations

hello.bro.wroklations
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4519

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
52124c0dd1d2ad5ac4e531613281ec29

SHA1
a8e5b9da3348f012e078ded2924955345f03b9b7

SHA256
dab6e5f05e35e3af47824ca3f6c9445fe77f7c65f4a08e7f35483fbdf3528b45

SHA512
874b8f0489921e636a45610b4a434bc0cfef24cde0e1355c4d1051f0fb9c46a498e819c6ab2ec7b2aa709ccc35252bb6a0191e9b395d79cc652faec1aa41ae68

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5d7b61ac055536d1aa02fd0652454d67

SHA1
2572653e50b18f6d6e1ff501720d110e3297723a

SHA256
2579f894e0ed663d87dba183df408a9fdd539edbceb127b4fec760ab57d80890

SHA512
9c6e9dc4bdb9e57af7beed42a387481c47abad48232e5431f57f2a963f27bb18c159bd1466ac695789488f1df263101aa97fa84ad073bd5a028e2e6b59a42e83

Download Submit