hook | a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664

Analysis

max time kernel
147s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
05-03-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664.apk
Size

1.1MB
MD5

bf9bfd9b6139c92df74386c2e224de43
SHA1

c60ef6b00fd93ed7595b390b92d833e15edb8812
SHA256

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664
SHA512

259d880fc8516827c6be79fc9e11a91512b81a5abe282936988da7168aba0c7a7c0c466760d838110f54f95e84f72d293ee188b605a9cc9a33a35d837aa679d6
SSDEEP

24576:XogIZk2MoXAFVDqB3f3KgUX5Ue2s9+iEVj3nIg/Ss3:4gJ2zcdqZ3KZXL2ZBnIg/T

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4322

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
418ce1fdb3cf557f7d2e364126b8bffe

SHA1
277a280edb016f5794cbf80af0828dd9ea02abb5

SHA256
dcd2ea9dd675146f95520233ff8b2764dfa6c0938c81a2d5baf058f18f8a9bca

SHA512
e6d262e916f45a5c5f3cc06d42fd54a3ff891966b0057543e5f28d635ed3ed3c1c88d4d85c6a3c1cd1d28249582336cb1f1a1823bdc6d88151adc8380b33f03b

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
42ca4990b53b397de8517a7e5e637867

SHA1
6b12aefd1b2008a785fac7099d17a871db62d662

SHA256
8e88d3c6fdea2241371bb4182f1b23cef83bbb5a46ed40430ba2b6ccda96fba5

SHA512
009a034d9020af2904c5842a88e864d7c9dbcf36fd27dbeab527bc2be4096b628b5429319031e118521d592ae925ad9ccb7b43b65d1c57b3a6e76f0011513c0e

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
c3917741282d8a45085962e856890bd9

SHA1
dcc7172a22bab9f385a6cf3252e81dc36eb3903e

SHA256
be3096ddb4cc44ab7ec9b76a9ca75ef617be28e2cca5f16a15f10c0239da946a

SHA512
a06176116edcba297d073e2ffe33a39c50f097b60b0aa89a012e7f94e9ddcf3281d3b42d4cae5069bb1f2e7db9ddbc8fe772a04bc0cad3d85bf9b101fb9570bf

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
77d44580703eb41e86593cd2fa9e77de

SHA1
8fbbe8ef55de0e0324bf064aaa0d11cc31683c09

SHA256
8a41f9685d5217ee180c8a61375ba32a69f84b7e9ecdf38f63cdb02e5f63ccb5

SHA512
c47d15f795b72f94fa594aadf95d9ade9a26a6a0fbea2d7afc131242f744d90e2ae1a330353eb62c83e16867a9c25760c8972d010d6930e9ef96964410900f97

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads