Overview

overview

10

Static

static

10

7c7e421374...a2.apk

android-9-x86

10

7c7e421374...a2.apk

android-10-x64

10

7c7e421374...a2.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240221-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
  • submitted
    22-02-2024 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2.apk

  • Size

    1.1MB

  • MD5

    a9cb55488b48219352f8c0eb7b5c3b72

  • SHA1

    5bd952beda27c8c16d88a3ac5e55a1ff9f1e67ef

  • SHA256

    7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2

  • SHA512

    9fb71720a0a6322e2d86fa349cb9c5dcdc78fe2e2f93601d403bf4ea1b87488d0b8006e3b0dd5cf29d08d6f525f919e9fa47e13c7bb9cd54b48fab8622f6e246

  • SSDEEP

    24576:f0AVatewyf+fWGsGzGYPz2LXR5yPkoMOgSYv:M+j2fWGPXyDD2TgSE

Score
10/10
hookbankercollectiondiscoveryevasioninfostealerrattrojan

Malware Config

Extracted

Family

hook

C2

http://93.123.39.169

AES_key

Signatures

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4457

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    69650c52d56525092f522b6b99f85cd6

    SHA1

    ddfac42482e100313d39797fafa351d038c38e3c

    SHA256

    d5a2f9c1a54207789c2abc1dabdb28222de70f04b452b10c5fbef85935d1c8df

    SHA512

    ce9071e80235e99be13463ec3a1c6a9b88019a7af854a7aee2ae2314ae95a5fe5c401c4f0a4fe945134584b7100eb2a9b90426fc9ec77561023c4dcb1ecf234b

    Download Submit

  • /data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    ba31606cfb195f7f8106c68d35a42b8b

    SHA1

    31dd8534a094f25ad2a1dbca60e34addc90ef372

    SHA256

    62128ff1955d56ec6d2b4415ed3e2d94dd2cd06cf73e531959d1a2e788c37660

    SHA512

    78409a056d6214224d29297990b0fb23c2d4e4cb5f45263c216629bd93c6b246f4bef3e7d5cb7b8233ffe578c9fee7473bc6e9866409813a98f5896f5e27c72e

    Download Submit