hook | 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59

Analysis

max time kernel
149s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
25/02/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.apk
Size 3.8MB
Sample240225-1xjeksde86
SHA256 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59
MD5 508280b8a33592fe3e3ec3bab918998b
SHA1 72956fc4394e95b0eef71dd330ef27d453cd2c36
SHA512 f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311
SSDEEP 98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://91.92.250.168:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.trendyol.market

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.trendyol.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.trendyol.market

com.trendyol.market
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4437

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 e2e6809ea76268506d9a192170a6022cc4f5b23d825c651009c9c319dc9d9c23
MD5 16b46b5f5e3fc5cc67dc1edacbfc3a8f
SHA1 51ce954f34e96a36b25ff3977a77510974530aab
SHA512 4c4c3009206f35c8e316ddbf1e264ac5b2b02731625c0b849841ea293345e9fefdde3fd4a8f88836573c24688c423a738a60a427b2762b4cca695838858345cd
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 e7daccb19ae7e46481cf451870a3df77464671203448d1d9739e6ac37cf5f164
MD5 2454dae480f7c0a63b8c283975bc7cf8
SHA1 8a1321c13630efc6864e1c49e3f60f21a753a931
SHA512 231f4886858d824068c368bdb214ac521ab2039be5a5eaf68bd9c4e06af1e71a1902d4172d61c3678874b2cae18129fee4b7790a455f3edcc74ca2e2bd7b6a62
SSDEEP 6:KGoLz2o9FZdrlOERX4PBX4ogLugMBX4suuK+/32XmGOw2:KhXTzdTRmBEyPbP/eOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 e85adf6fedd6bc208c987ec778199276499b586f58808d4914a8d5c089f93682
MD5 0f5dd04bf43f0dac98c3f1cfd9f6d53d
SHA1 f9392b1d8e6e91d2229d5c4a29bd43629484947d
SHA512 013eb342dfe4c53fb241a458ed5e6a3fe9023b64052ee9d5a16eb53a7ae26280949690e23244f83b544ac13cc02654f11d4db6811a194c7484650bddf7acef43
SSDEEP 96:4kZ6+hdjnHtDRMpf8UzS5+TD8q0ExPyZTd:bVdjnHt9Mpf8UzS5+TD8q0E5yZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 9dcef750fe72cb6264c394f82d39145d138afed0cefe950eff17cf8179363fc3
MD5 d3a648811e4ef411f823dd127a38aacb
SHA1 92b8cb8fd6b157fe5bd228e07c8c83e7150cd640
SHA512 06c2cd128e83302938482b55acfcf39e71e81d72df1ec3d6b7056ff607a0ea3ced401ff466bfa7ff0d44f7dc2a8a17a21c7484e22208ab04d8b5189fe44e6fbf
SSDEEP 12:VXdgk0MMUMXrfqax3LPhV0E1CgJMk7+ITMk7FlX38Xp9O4338tlgFMMUMXris1GM:VNwUYf9lP45/4lcjcMUYf1Ul5VQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads