hook | f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf

Analysis

max time kernel
152s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
19-02-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf.apk
Size

1.1MB
MD5

eb61c894491a192894ef5fdbd3050fba
SHA1

c416ebd5c6a51ed1e42756f0e99420fd6541cce9
SHA256

f572507ff9ee880fd5d69464a664571d3eecb9a04e48ad0f165c6f804aeb47bf
SHA512

82c211adb2b7b9cbd8946dc14514c8672127eed5e63d78ca29c7cf9c3e7796886ad2223235790e4a1b3f965fbd362a30db89d81975749d5deea6818ad0ed0591
SSDEEP

24576:wdcIPWAeDMNPJdLVOk1ipG2lB7jzY48ojyun3g/lnN5:wpPWuJqAipG47jzSXun3g/n5

Score

10^/10

hook infostealer rat trojan

Malware Config

Extracted

Family

hook

http://163.5.169.11:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
93b0035ea715787e0f563f854b70a08b

SHA1
a50dd8f048dbc35f520122fa79d1871165733360

SHA256
7ae8f5b00cffb05b57a0989beb1db2467edbecf8ce8c6fe95a0e9700fae0a8e4

SHA512
dbe32fc407a9474a0f029eea9be5d8fe1ec3390232d23ca5fc6b83883ab1ac9dea40c79963fcd4929a9c87589a4ed2096a9db40d8b2387a6599ade48691c7412

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ff2210306de163b4bf234610aef1e688

SHA1
894b74f9552f4282574052af610fda5975e06f11

SHA256
b985aec06992c07522de7f5abd581bad35cdfa6bf96c6c852753b7f02bd1fb3b

SHA512
f1cabf49683fa255284bcf0efe1ea7534657c10e6f3b8efef0fafaa18880e69ec8f1836da14d644cb8ecd1884603ad8f423d068adc9b4560eef1ea8efafaf29e

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
9ccb8d4d138aa1f96ca6491a229c9bf7

SHA1
4340e4b191b0c426e3a6a9668ec91bdfe5f53aad

SHA256
5c8282b1ab686a96526ddd084329c66be3634d01491afd34beecfb218e69ccbe

SHA512
7f2ddd89cbd6e0bfa69b021519512213c915860370f202eed3901b11ff7e0d012a70edae5114c8bd77509fa6c0971c18ac2a3c9ad270abba3fd74201ebc859e4

Download Submit