hook | 0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f

Analysis

max time kernel
150s
max time network
152s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
05-03-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f.apk
Size

3.3MB
MD5

8d958576257733bd78fe81f84e768ed1
SHA1

cd19e464b30b42d80a532cd994828696dc5f7b9b
SHA256

0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f
SHA512

9352203c5c06e69a2521041f3eb4751af80295ac50828b3e6a7d653198e6fb4db671b2fa214e3e3c166cf2a4c22ef54a5e87e40d6ce145a32a5c23b71a487683
SSDEEP

98304:TAxM4GZm5vjgae1B4IIDjl5OMxeAPuYXv+r5Pd:xZwMaQ4ImlAYeQuYXv+r5F

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://77.246.108.116:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4186

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
4290cd8c41c3ab7f851c6e08ffb8a625

SHA1
33a901bed066996a669b5edd6f53e56236619ff8

SHA256
f57857214c79cf546292f9076ea58038649c512fbac23ad1d8ceaa25fb2ad7ff

SHA512
4d2147204f2a2728d5d5690a5786887091a0533109860d9b6c671d663713e64bcd2402ea52b9522db532c022711ec02e125c2f1322c0e7a3a9f9ff65811abf87

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ab2c6c758865cc93766ca06924c601ce

SHA1
68228ae09139115a1f708d2325e934df81f00bdb

SHA256
bf58bf82bfb776c8eaeea79ea26a0d1044782bdb35d428154d79a2169165733b

SHA512
7de8d7960ed405c54738922836aee77583fb63f05796b2e46b643c8896ceea860c359575dde7f9974e5da20ed7e7869de2f8acdabfc2facf6e13cfd03f82fb5f

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
db70b56b4722cb002e3a95086567c828

SHA1
20ca9c6cc32e742c9724a4089d91b7cc77adb761

SHA256
aa10e6fe31e37acd2be2f05f977ef406877e1b61b86a8ce01c0ededa6234713c

SHA512
57b0439f95782ec2e2a46d3ee24e7ea3248501e82cb52bb0fd9d509a16213c1abe8bfe9070756ccc7af75905129c97fcb5abfd6dea76a3e5adee00404959955d

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
30f5eb376aa63006926993a03c320604

SHA1
2bfc970c9ed8c18de63b0702fd11848e6ff109b8

SHA256
3d1a4a0595d7956a0daf86ee68a3849423ae1f60a945e4bad08d963081511ced

SHA512
cab60b68f8bee87d0285714923d62bc2ba46af96cb073acf62e8d1e071c3904ca17ebb3eade77be41e6acda77e047ff8ddb9abd78eb31f09cfa86d20c88c03aa

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads