hook | b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854

Analysis

max time kernel
157s
max time network
167s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
20-02-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854.apk
Size

1.9MB
MD5

676070d6bb6a46802e00d662fe0666cb
SHA1

a7a111b8dfee9774f5fd5656c02cc0962a4b454d
SHA256

b6cd946497995ffff706afca76d3139d9f992f42e2524f8b78a863c8681b8854
SHA512

a1f991a900d5ada4fc7ca2a891266d60c39e14f065afb17c8753aef6276cdee71d0f713ce64d8e4d2045443a209ed1d09ef2e7522b28d86a9a18a87d056391ca
SSDEEP

49152:jEmKrjPT0dWF05dLMVTFdr4pstRMhE5HJ5SRX:iPP4dWWbMVTFdr4ePh5yX

Score

10^/10

hook banker infostealer rat stealth trojan

Malware Config

Extracted

Family

hook

http://94.177.106.48:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	hello.bro.wroklations
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	hello.bro.wroklations

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	hello.bro.wroklations

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4518	hello.bro.wroklations

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	hello.bro.wroklations

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hello.bro.wroklations

hello.bro.wroklations
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4518

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
bef6249fe04ed0ee28fd33c0a8638154

SHA1
cfdfea60e6e8e4a3f2586c5dc34bcfb18c8c4893

SHA256
43500fe90b834a8708ad06ae50fdd97e5008008ab60ea3d9ae95924441387462

SHA512
1ce4c54511ec0e2cf17581fee777c68a83fcd50dd18b3d7f9ac3563018fd89847c131eda5bda44f4d9caa9bf8d024bce2f96e630ef43406c3345922f7e4f068c

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
bdf790c5eaa98a5cc3f71cca0f6dc7dd

SHA1
430cd100e1d0ecf03e4c119deaa2becb9403085e

SHA256
99b170d560a739c5be94ab7b713e812c4754f72d5fe0f2b6029fcc1710663073

SHA512
5957f8ca6613aa32cea9c771748af57b97ca2261e08fe4953ef659449aa0834e01008e3e858097255e0d38701a4fc392d6d1d4594ef8fa71442c6725f595cd5f

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
84KB

MD5
18b0210de403c5a56fd5f8e1f7976389

SHA1
d73dbe42cf4ac048831f80952b27f0d11a339856

SHA256
57485384294d82a1d43836eb37b03e46b833840fdd8f4bbf5bd101ead9b4a20f

SHA512
c340c93e5caae54890f975c3d6ca5e255c5b1b8f3ad925bb24b18bbb99dfb35fb353cd248079a59ea786a195f664e5649bf34db761b34e8a0cde4db1511e4836

Download Submit
/data/user/0/hello.bro.wroklations/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
e8a836050cfeb4355f24f127b4084a56

SHA1
32e34abb7f13b365142fac1dba4aee749659bbcb

SHA256
b39a721c28bd213488a2beea97fda6b0f9d3974a25da2906ffc48185ea96473d

SHA512
ef64eeffdc9bc3029438b7108b56a7cbc3edcfcf2be956a9a8efccd480d6855f079d009fd47133ffc26c2375d01ce08cb48cd297eb5edd157110c68b55d76263

Download Submit