hook | 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59

Analysis

max time kernel
149s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
25-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.apk
Size

3.8MB
MD5

508280b8a33592fe3e3ec3bab918998b
SHA1

72956fc4394e95b0eef71dd330ef27d453cd2c36
SHA256

560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59
SHA512

f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311
SSDEEP

98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://91.92.250.168:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.trendyol.market

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.trendyol.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.trendyol.market

com.trendyol.market
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4437

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.trendyol.market/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
16b46b5f5e3fc5cc67dc1edacbfc3a8f

SHA1
51ce954f34e96a36b25ff3977a77510974530aab

SHA256
e2e6809ea76268506d9a192170a6022cc4f5b23d825c651009c9c319dc9d9c23

SHA512
4c4c3009206f35c8e316ddbf1e264ac5b2b02731625c0b849841ea293345e9fefdde3fd4a8f88836573c24688c423a738a60a427b2762b4cca695838858345cd

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2454dae480f7c0a63b8c283975bc7cf8

SHA1
8a1321c13630efc6864e1c49e3f60f21a753a931

SHA256
e7daccb19ae7e46481cf451870a3df77464671203448d1d9739e6ac37cf5f164

SHA512
231f4886858d824068c368bdb214ac521ab2039be5a5eaf68bd9c4e06af1e71a1902d4172d61c3678874b2cae18129fee4b7790a455f3edcc74ca2e2bd7b6a62

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0f5dd04bf43f0dac98c3f1cfd9f6d53d

SHA1
f9392b1d8e6e91d2229d5c4a29bd43629484947d

SHA256
e85adf6fedd6bc208c987ec778199276499b586f58808d4914a8d5c089f93682

SHA512
013eb342dfe4c53fb241a458ed5e6a3fe9023b64052ee9d5a16eb53a7ae26280949690e23244f83b544ac13cc02654f11d4db6811a194c7484650bddf7acef43

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d3a648811e4ef411f823dd127a38aacb

SHA1
92b8cb8fd6b157fe5bd228e07c8c83e7150cd640

SHA256
9dcef750fe72cb6264c394f82d39145d138afed0cefe950eff17cf8179363fc3

SHA512
06c2cd128e83302938482b55acfcf39e71e81d72df1ec3d6b7056ff607a0ea3ced401ff466bfa7ff0d44f7dc2a8a17a21c7484e22208ab04d8b5189fe44e6fbf

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads