hook | cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b

Analysis

max time kernel
148s
max time network
146s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
05-03-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b.apk
Size

2.8MB
MD5

dd1d59363757b52f1a3139847fc30890
SHA1

38db10d0719d2fdc438deea7ea8fd8e4facdad4f
SHA256

cb0851d5c0b5890708efa8d9b745a27f64c4fcdef87179067787dd8ea44e220b
SHA512

b23d5ee3aa0f1d277c53bf6d502d805a57e640679488ba03c4f68d4a882f9de6cbb1455e30eefff5181d1f5177178f2f7062c168d28204b3d0509438bef768f6
SSDEEP

49152:nozl7D4fxxqNsvuha+i4bLkzLfGqg8k9IZKxfVf65q4h5xxKAC6lg/In:ozls3hiaR4bLkfuqCsKxfV65q47xxDCk

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4271

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8396465ee3d5884256b0f8fe7c749852

SHA1
dd7b452b302658a68aacce81306d05fa06e39612

SHA256
e5f10c907c4b2e43bbb1a0941204b0c215af77fa863f6579b472ed2d851e5334

SHA512
94a36ef25e63b24a50aa1b6e4e77ba4e15bae8a96c09d76c4240c2b5d16b1fb51cb85f068bc1f53c1a2655b67a8510d68e3c79c9a5cab6fc9ae9bb2f548ca3d0

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d7e4c60febca456897fe5be571e9f383

SHA1
f628633c48416a7a409580d0d1bbd68513ccbe9e

SHA256
4675ed7df7f5d0d2a7625b4e76b9c69df4a00af2968d6a202ea1f94cd50049c1

SHA512
9395dc44686ba58c8b37f80667367c03a885b05cd839665f652b3a135cdec2c458c56cb3119b842a9f4ccce31be052324ec2b86d78166b63475f1298f94138af

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f54be6c5c3683fbb73749cdf8019b329

SHA1
f68ce21ef15fe12ac456b15cc6a3cd0bab6f2b88

SHA256
71fbb7b856b750a67b1a9f127af62d0a5f0144038cc3f23b34fbd80e59c74f7c

SHA512
996c269e1c92a2d3f5ed0534e178a9475259a4c762f9e8e7fbe0f4cb5f578e789c950e84e8b86f53a719fe91b1001b538d15621e0f1ec9bc5c75683feef09347

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
8dc5db8c025caf0ab05c91ab0c434c47

SHA1
60b56d7259122614fee4cc303bbcaa87e950bf03

SHA256
1765b3e9fecc2957eca5a4c992d795572be8ed5ba97cf38ffbc62e7bc0b89302

SHA512
aa795a3a8a9d321f30b32d917be78fc715b67950ff6c82a6ed90020fb5847e13890a7095c2913e6533c37fa88dbec8d8574d45179fa8241d0dbc48fa88aef1c6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads