hook | b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854

Analysis

max time kernel
150s
max time network
158s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20-02-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854.apk
Size

1.9MB
MD5

676070d6bb6a46802e00d662fe0666cb
SHA1

a7a111b8dfee9774f5fd5656c02cc0962a4b454d
SHA256

b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854
SHA512

a1f991a900d5ada4fc7ca2a891266d60c39e14f065afb17c8753aef6276cdee71d0f713ce64d8e4d2045443a209ed1d09ef2e7522b28d86a9a18a87d056391ca
SSDEEP

49152:jEmKrjPT0dWF05dLMVTFdr4pstRMhE5HJ5SRX:iPP4dWWbMVTFdr4ePh5yX

Score

10^/10

hook banker infostealer rat stealth trojan

Malware Config

Extracted

Family

hook

http://94.177.106.48:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hello.bro.wroklations

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	hello.bro.wroklations

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4995	hello.bro.wroklations

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	hello.bro.wroklations

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hello.bro.wroklations

hello.bro.wroklations
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4995

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
01f39cc934907a1106f7caaf47260c3d

SHA1
a2d09e0ae047184bdff27b0d10421132af16d7c2

SHA256
47298d7a63e0ef1f6498665151b05c9ed6753231583dfc39654eab237aa84848

SHA512
65ca13dcb1d9736d880b8d2e5a14928dcf6540e0df26e0f2cf0348b07a2290c7dd98d427facd15b041f8aaba8eab10a7b26673eaa12f73e3dec7a35e2c4ef664

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
90ac8717d0293e80d25b13cb29c6e1d9

SHA1
bc3f6c3abd155fd776199fa30c82072a643ca0ea

SHA256
178b630d84d04cdab4e95f6ec3239be35e417b769545984e1ff5495faba04bca

SHA512
ffb5c6b377f6c5655fb268a18e4ebf4fbf903c2f29fd0fb3778ef818f5c4589aacbf4157bf434dbf054ecb281a4fed0fe6bb5cdc3988604dee9eec3e2b202ad1

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
b57dabfe353318e57263bee60722bf57

SHA1
126ca00cd4669d52847fbcc5733d5b02b04bac82

SHA256
cde196cb9bdb5beee63b845d272c3e39ae9745e3e88ad85dbde67c2db1caf24a

SHA512
d8bbf12fa2e227bda561a661f831fb82a81c3ee0e39df54a9c35f3925dfd336cac0f7b7f22b94ea35ac23fe8af21eca52ee3f34f692b42b89a71b7c3bdeb212a

Download Submit
/data/data/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
db34a7b8057aa7df4b08edc9b4b360f1

SHA1
6c06e425572de9ce41dac7d7719acdde0afa6c0e

SHA256
0c2091a2b5408556b35775b142fc87e98a9ccc9ad9dc18f339f56aed4a771c75

SHA512
c8652eea39c47e5ea24eb2e4bcb50f5796a167960a939459b360a088963687f87a0dcd4d59e8ec83173eac95ad381c6543eb84d089ea123378b87cbf2c48553d

Download Submit