hook | 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59

Analysis

max time kernel
155s
max time network
160s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
25/02/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.apk
Size 3.8MB
Sample240225-1xjeksde86
SHA256 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59
MD5 508280b8a33592fe3e3ec3bab918998b
SHA1 72956fc4394e95b0eef71dd330ef27d453cd2c36
SHA512 f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311
SSDEEP 98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://91.92.250.168:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.trendyol.market
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.trendyol.market

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.trendyol.market

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.trendyol.market

com.trendyol.market
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5071

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 4506314289851944a9063a3f1c4a0d9f32d304da30f1b8908a542d788e113279
MD5 b3dc68f0f783af9a52c4505e23c8b87c
SHA1 fcc5dfe1a06b0e5bc91bee3094b01c015f1bf33c
SHA512 3f7fd4f79c76095557d6fd4518f3ab277e434f39bae6e3600f5862f47850f5bc7ca70dcc622e61a1f4a0e509b096c7c94c3aee8dae65e71bef8359e16f8ce6c5
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 b283df1e6fe06ecf56f33abd423b37367c4ade6e0b62cfd1345d2ee2927b1f1e
MD5 949e09575c0a1efca5507d79c54b200e
SHA1 e9a0d11d1c569a0c3694de6ab656cc9cd5ba66cd
SHA512 e8de6806d984adeaf718e581acfad63a99767673153c5ca53966a3006c49dae3311bdade17e881d5372207820f78c674a9fd9c003caf67df909aeb295b36e939
SSDEEP 6:KwB4sfd4e9FZdrlOERX4PBX4ogLugMBX4suuK+/S4A50sDpXdjiOw2:KwPpzdTRmBEyPbP/oHJdjiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 e60423bf0303e120230a643af60bad53d8b747659074b52e69d8bca8f5a54abd
MD5 bd2a8b56086289f93e7aa041e33ede2d
SHA1 135bd0b7287d3eb97ed5acc0b19c8a9b487c4268
SHA512 5261e795611ec1d5a24d050f02feb6d5ee397ecd9a8fa729c7d913c6f36db5cb7d73670c69bf7510fb9892ef0cdb4bbd0b5df54a3d1a681345e656058396766f
SSDEEP 96:OkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPu+lm5Ad:1VdjnHt9Mpf8UzS5+TD8q0E5uad
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.trendyol.market/no_backup/androidx.work.workdb-wal
Size 148KB
SHA256 b84aa35b6c91c34eb859176ca8d3d36041194ea2bb3be5d8dd33327dc0492423
MD5 7d894fbe729fcef656133d24efd08849
SHA1 f6c6b55fa02a776aae6c704a16955e3377fe5cd9
SHA512 9c464e16be292ec442426732b4e480cd887290a5c472b2a5d709efc740ef002ed6f3445ef071ce866205fd1ed05bdb7522dc068cb5516ae7e3d32e22db11119c
SSDEEP 12:beCdgkmgddMUMXrfqMP6dRh0yJ1G3gJM/dRBBITM/dRjP6dRdOXDAdROsAdRzkPU:be6SxUYfZy8Njxrh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads