hook | 8c0f2137ad6e952559d6a1a2aad8f3495e7e609f437cc048957bc9ebe463817c

Analysis

max time kernel
150s
max time network
157s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
25-02-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c0f2137ad6e952559d6a1a2aad8f3495e7e609f437cc048957bc9ebe463817c.apk
Size

1.1MB
MD5

a8a5f42eb631b721981f6a976e749b84
SHA1

ff646ab48ca2363fe440ae24ea1d9070efe328be
SHA256

8c0f2137ad6e952559d6a1a2aad8f3495e7e609f437cc048957bc9ebe463817c
SHA512

900e4be797a26d1bbc4dcc8b592f93bdb89f96b8152b4a71f599e10dce195094f0859a7f008ae3c63ce3c1ddd51399a0b1ffbd2febe06fbbc506e40f327554be
SSDEEP

24576:A6A0LhA8dB/nVIRBBY9CYDuPLXojySrg/Vqsf:A6AyFdB/nVIRB5YDWbXSrg/Df

Score

10^/10

hook collection discovery evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

hook

http://77.73.129.77:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tefawowifike.suyehejo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tefawowifike.suyehejo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tefawowifike.suyehejo

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4254	com.tefawowifike.suyehejo

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tefawowifike.suyehejo

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tefawowifike.suyehejo

com.tefawowifike.suyehejo
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4254

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tefawowifike.suyehejo/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tefawowifike.suyehejo/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
38a05383d937efba15831a7a28cc42fe

SHA1
c97ecbf09babe841a80ae921cdf7bdf5d651f7a6

SHA256
e03b0ab20762c546173112da45c02e89cf5460300a620d25fccef9ec8cc53423

SHA512
744d0b38e95ee74f66336a50d781d5480bc38a70b192f3af8bf5753efe0aa2828605a3f74710677a14a21442f1641d3ea574161d6b63fd5d0c4eee5c5fc9220f

Download Submit
/data/data/com.tefawowifike.suyehejo/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.tefawowifike.suyehejo/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5aeff89ca9a7d4118909efcdad04a516

SHA1
c6e73cde49ff0be7df65982f04903fa9185e2cb1

SHA256
746d985861818625bb279ba2203e31b02615f0af412bda762510b97c55bba146

SHA512
f99fcf83dfbb822bd8e09ab6a95a139f68d68c27bfeef46393cc35f89bafc577fc8cbdba9cf93638b7e997d44f5d3ba28fff33e1bc67134b058a861c10e9dabd

Download Submit
/data/data/com.tefawowifike.suyehejo/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
01d5504dfd4b5f409fde13a1d5975429

SHA1
f9b0853f537fdf11b272d19570fb2bb5822b348e

SHA256
23e6abd6dc3063b7beac9acccb061679ab4f5d58c4ab8e8353dac03275902e91

SHA512
9b58d30755777821c84bc48f8ca1dcc64afb536789b23b1a0cc9b1c30fd479318832f9901f0390cd34d3b63cd1872a19fe3d0bb1ff3bf2c954b844f8442e2410

Download Submit
/data/data/com.tefawowifike.suyehejo/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
135ba8874186cca8fe75491abed32223

SHA1
fa38f883474bd9bb74ea29ac86c501b3a18d9096

SHA256
3964f47d51c8af06a33dbbdba0d4a32a14ebcd4782b8b1d56ec53b187dd7891f

SHA512
5ca64711349a8cbcb9f0be612c38bd282d088a456c8b2faf564490c80f898f2f67ab041b901757c243b1eb97add5e07b407cce8948ff56717cca2ce7446099cc

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads