hook | f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf

Analysis

max time kernel
42s
max time network
156s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
19-02-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf.apk
Size

1.1MB
MD5

eb61c894491a192894ef5fdbd3050fba
SHA1

c416ebd5c6a51ed1e42756f0e99420fd6541cce9
SHA256

f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf
SHA512

82c211adb2b7b9cbd8946dc14514c8672127eed5e63d78ca29c7cf9c3e7796886ad2223235790e4a1b3f965fbd362a30db89d81975749d5deea6818ad0ed0591
SSDEEP

24576:wdcIPWAeDMNPJdLVOk1ipG2lB7jzY48ojyun3g/lnN5:wpPWuJqAipG47jzSXun3g/n5

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://163.5.169.11:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4257

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
6d467f52ac02d07b9503c520692678df

SHA1
51e6bfb03df819d4c8d59b7f9a20f2e6d9a422e6

SHA256
0bf16ab3f519be576d2f7d1ce078a8070d9892f45bf0577cf8be7a3e7b0be8d4

SHA512
e82ad992ae9ee6bd4129ae125c186b287bd4af62fa67c844eaa9b6c891e7ec453b0096c21e4d75b1bb99b0a0d897befb3932a05b028df62754d352b9d6f29614

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
29b07b2ce6e08700a3f05399236ff5d9

SHA1
e483cc96e2c71d11e1986b33448ab0c1f0c5e85a

SHA256
6b3e4e66eba7299f9da40767c4756d741a1c6895d541010be2d197b7b05c8f1d

SHA512
b787ed27c2d9cb004e30482d91d496f9de61725b4138e68a4724f0e1e98e490683824befac4800f67c0bd66450a799dce25aba75ca3aefde35edbc6a45866dd5

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
a8d28f24a8eecf729012a7caa2aecceb

SHA1
abb16fa61a33b7b9ca895aa3974de6fd6c6793f9

SHA256
ceef5e7168bb691d5f173aab11eeaef2f3b523c92e2d12e18fb66e96462478ad

SHA512
959050be1b0914a01dca9991458a877eb64ed211998fc25c1bd6ee8d80762efc0a98543a18789c6075be3b61b6abf27bbf9de928a4faeed34bc3a3f621c2ac2a

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
8c31defb70949c6596e69f737c1bec5c

SHA1
f55dcc609a6a3e147d43d607f63ce86289d08813

SHA256
88e8f4dc4ccf88bfd6a18a876f0bba0a42c31a510fdddb8c4d091e104d5c734c

SHA512
0d6afa620b90e57cf09328e7664214c21f3fcb0e8ca10e50b6fff28b91bd197a48768fcf858a6b0984460876ff654f830ef6e3f033ef64636f157e108ab1e66e

Download Submit