hook | 6d56dad02e1c2605b05913c4b3362c50988d3837db7823a967b651e1f066b8cc

Resubmissions

02-03-2024 22:03

240302-1ykn2ahh2z 10

Analysis

max time kernel
55s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
02-03-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d56dad02e1c2605b05913c4b3362c50988d3837db7823a967b651e1f066b8cc.apk
Size

1.1MB
MD5

1c1aed6897e399e9ad0afa887370dbe9
SHA1

52b8ec43ba94b2244ffef3f7a57ba4e7dd9bc376
SHA256

6d56dad02e1c2605b05913c4b3362c50988d3837db7823a967b651e1f066b8cc
SHA512

7e03e8fd4da627ce54cd68737180828ef8d0a21a811ec00c4d73320b7bc42794ffd0266702f994c6e19d5f3597ea25d5f83b17b1161ca02040a1cf71fc4d98f3
SSDEEP

24576:Ti1wlIMotJvnFxgmxChd+FUGCnwiRIr5tjyXUg/ZgJ/Iv:TiiKxgmxM4UFwig5gXUg/1v

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.gitowimowotoki.dowa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.gitowimowotoki.dowa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.gitowimowotoki.dowa

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.gitowimowotoki.dowa

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gitowimowotoki.dowa

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gitowimowotoki.dowa

com.gitowimowotoki.dowa
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4374

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gitowimowotoki.dowa/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.gitowimowotoki.dowa/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a294b85955112c8e951e7085e01618e6

SHA1
94aa8b0a7a15c0f0f7ae54b650ce2e57ade92e6d

SHA256
efe73961ca8cce938c2343526cd86436d3f856161b93ad795acf20a5325268c5

SHA512
da2bc295a606d641169c0e14afe88d9c9a4152998d0ebfa6cc766f35299f24111765a2b827c371e97e760fd58907a70014ffd6e32fa6dbb6b0b389ef391438f2

Download Submit
/data/user/0/com.gitowimowotoki.dowa/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
b3ac61516e359fa9cd3821dd843cda6c

SHA1
763152c42e1a199120ad21ad812ab88e4caace71

SHA256
725016e486270b79b444b15763929c2cace44a050baa441a4860c45d410a8983

SHA512
489058087d3d78214677b7e04806946236441235b9e4072e0316aa81080e8ead0722931cfb8a3a27d0deada21b2c77460e12c943ec2c7f84e0df008a8abdf926

Download Submit
/data/user/0/com.gitowimowotoki.dowa/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
dc2a4536890317f60364f437e5e03212

SHA1
92f2e5b4b77f4ea0b2dfe82ce8f4acb3c0b893df

SHA256
d14a6f1c7aac65bc8d852aa73caa025138cadfe4fff7e6ebd30f27e135ceb8a7

SHA512
7b40d27b580647a7f8ea55a7390627117ff13ff7e71038339341f7b14e8645bc769f0cd68282cd65bf1b17c9439e50f7f545a66125388d582600ef6b643b422c

Download Submit
/data/user/0/com.gitowimowotoki.dowa/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
3ad52542bfad0abd7290990a5a468115

SHA1
8614eea8a9223fd1b3aa037a483e331949bb1693

SHA256
6bbfd89ce4f7563d699f9038ee340d2ad9acf7ef46e9bb291c35997440683b8a

SHA512
ba6fcf00a5dc730db916253969776d986f41dbd3d3cb1ecf7dd7f1e3a81110cccba345ff0fa14b0349607e7ed83583ff369a24c56e887421e88bf7118eb781d6

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads