hook | b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20/02/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854.apk
Size

1.9MB
MD5

676070d6bb6a46802e00d662fe0666cb
SHA1

a7a111b8dfee9774f5fd5656c02cc0962a4b454d
SHA256

b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854
SHA512

a1f991a900d5ada4fc7ca2a891266d60c39e14f065afb17c8753aef6276cdee71d0f713ce64d8e4d2045443a209ed1d09ef2e7522b28d86a9a18a87d056391ca
SSDEEP

49152:jEmKrjPT0dWF05dLMVTFdr4pstRMhE5HJ5SRX:iPP4dWWbMVTFdr4ePh5yX

Score

10^/10

hook banker infostealer rat stealth trojan

Malware Config

Extracted

Family

hook

http://94.177.106.48:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hello.bro.wroklations

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	hello.bro.wroklations

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4253	hello.bro.wroklations

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	hello.bro.wroklations

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hello.bro.wroklations

hello.bro.wroklations
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4253

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
b07354d3c4ddc779dd8576b5bc840b01

SHA1
8599e6f549a7a686956ca795cc17f60fc9b4f496

SHA256
8d5413dcfdb673ba7baa6c1af634a78dbf2cf2987da7e0edbeb051588382b96d

SHA512
da422ca2883242e35335a7799bca37bd588dac957c8c520e3ba293e3e54cdfa17fe08710fa4f0b7868a3b4aa7f437d440515b21a5e1d8893da682dd4b5907a15

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
97ebcf15bc76ee6962e7f3273d1666f2

SHA1
12498ae750cf79f8750d82bff8e42b49777b8141

SHA256
b8eeef58ad3b15144a724161de04eed005c1e2e8f78d969b121d905167d5356d

SHA512
f8dde26728a289dffec9ad3e23ad6e3a209eea4b3282c85d7611301f69c58fb9466ea2bc4c7c6157ee0a9dd5c9977da9577c3823f295cac2d4d9016e0b8530d6

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
bb668335abcc334f09cd3042915bf60a

SHA1
bfda2a3322f71a1b2ee3a04377c3223a24a5bcd8

SHA256
1b3b7014becf806d668daa1035009b02490ee50dd2be62ac281bdde8a0ce1297

SHA512
0755efa784e54f01ea550ac7cc7d7241d4535d325ef595c13d33e222a78c28f911259a23cf98d2e6a849a07ab2926321f8577e4ba82af93ad3f360ac20004162

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b078ccbf94a0916ac2922cfa5f695b34

SHA1
0897855070a4bf85cc29ef666f1d9b10b15fcd2b

SHA256
ad2dca5b3e0253d21c89456f97301431adabbdb6f2f84ab294885e63103b1a6c

SHA512
654becd4164cf348db121cc2c0e5f6f39c422271062145e3477a441c62177452349b42fe46cc5a2a9319e7aebdf5b17101c4478dd73dc34a38edc5b3877cb4c6

Download Submit