hook | 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59

Analysis

max time kernel
155s
max time network
160s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
25-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.apk
Size

3.8MB
MD5

508280b8a33592fe3e3ec3bab918998b
SHA1

72956fc4394e95b0eef71dd330ef27d453cd2c36
SHA256

560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59
SHA512

f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311
SSDEEP

98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://91.92.250.168:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.trendyol.market

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.trendyol.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.trendyol.market

com.trendyol.market
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5071

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.trendyol.market/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
b3dc68f0f783af9a52c4505e23c8b87c

SHA1
fcc5dfe1a06b0e5bc91bee3094b01c015f1bf33c

SHA256
4506314289851944a9063a3f1c4a0d9f32d304da30f1b8908a542d788e113279

SHA512
3f7fd4f79c76095557d6fd4518f3ab277e434f39bae6e3600f5862f47850f5bc7ca70dcc622e61a1f4a0e509b096c7c94c3aee8dae65e71bef8359e16f8ce6c5

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
949e09575c0a1efca5507d79c54b200e

SHA1
e9a0d11d1c569a0c3694de6ab656cc9cd5ba66cd

SHA256
b283df1e6fe06ecf56f33abd423b37367c4ade6e0b62cfd1345d2ee2927b1f1e

SHA512
e8de6806d984adeaf718e581acfad63a99767673153c5ca53966a3006c49dae3311bdade17e881d5372207820f78c674a9fd9c003caf67df909aeb295b36e939

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
bd2a8b56086289f93e7aa041e33ede2d

SHA1
135bd0b7287d3eb97ed5acc0b19c8a9b487c4268

SHA256
e60423bf0303e120230a643af60bad53d8b747659074b52e69d8bca8f5a54abd

SHA512
5261e795611ec1d5a24d050f02feb6d5ee397ecd9a8fa729c7d913c6f36db5cb7d73670c69bf7510fb9892ef0cdb4bbd0b5df54a3d1a681345e656058396766f

Download Submit
/data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
7d894fbe729fcef656133d24efd08849

SHA1
f6c6b55fa02a776aae6c704a16955e3377fe5cd9

SHA256
b84aa35b6c91c34eb859176ca8d3d36041194ea2bb3be5d8dd33327dc0492423

SHA512
9c464e16be292ec442426732b4e480cd887290a5c472b2a5d709efc740ef002ed6f3445ef071ce866205fd1ed05bdb7522dc068cb5516ae7e3d32e22db11119c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads