hook | 3c21e47c0430495ca819255c0bfde2d30d1e121dc09d174f3bf4d5797929f2a1

Analysis

max time kernel
49s
max time network
162s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
05-03-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c21e47c0430495ca819255c0bfde2d30d1e121dc09d174f3bf4d5797929f2a1.apk
Size

1.1MB
MD5

397d193739f87a3c4ed4a5fb9cf8f43a
SHA1

e30b5f0a984dc3200e55db689ed5defed5efaad3
SHA256

3c21e47c0430495ca819255c0bfde2d30d1e121dc09d174f3bf4d5797929f2a1
SHA512

58a1ad4e3ebd5cf7dbc82ddb6ec9acf00a25a62ee620c480e9ec4d329edbba0df3ad78d80b4eb11687687611ef55a522ac1dfe131a9667e841e97f72e92017a5
SSDEEP

24576:a6NKl7FvoGo1DMRaeq2lfnXTB2I3hmW3+NUr1ojXmhP07aUdg/bMpk:a6UD+DMR0iJhL+Ii2hPXUdg/0k

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.google.bg
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.google.bg
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.google.bg

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.google.bg

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.google.bg

com.google.bg
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5111

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.google.bg/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.google.bg/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
dd3b32b775958d38ecc89d89727e47bc

SHA1
bc8ef3c8d54eb6bd8869a5ca70e32beaa19389e8

SHA256
ab4af2517d7f2841b8db5705b1da09e987ef8d959200520b9111b1620133f38f

SHA512
ff2bf66eb1ac839839d48317a7e10d92737cc57eeaa2082a1934f466e7a22dc14858a86d85f9a13b89a61eb371099801aea234dca8daed37e4c6b7b6dfee611c

Download Submit
/data/data/com.google.bg/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6116e8d14da4cde105648547945bf7b7

SHA1
4ec221991b146f763d11dae122c0e406e57bce30

SHA256
72680b5c0a3e434fc251ea7b1b50e40c173f8e40ff49a2edb7101453f9bc64ff

SHA512
aec62f086258db14e149d1bbcf7f4609fdec50c70b52b8ccad457273cd79178962937af3451f6ec6699d855af3b297d8203bd5dcca1720cc6ace9fcef1c4c028

Download Submit
/data/data/com.google.bg/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
9c1d9f4c39b14d7e6f1c602817590cfc

SHA1
0c85d1b58f2e2f89a95bfa2cdde18b6e7f31d30a

SHA256
e3f4530847dd92a72f2a2434f1adb523d3633fb9a45d93b3df56f47353029308

SHA512
4dd1a09a09820b6f84a869c9411ee3a627688c74ea8d1ee09d65083aa0048d2a536c7a524bce5231b4243838953caa339611a81a4d94cfb81da8bd18851ea0f3

Download Submit
/data/data/com.google.bg/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
27ec6379a61ab0dbd4e6334807d72089

SHA1
70d4c98fe4edcbddd26cf380f8baf5553f3729e8

SHA256
89e6157fa6d9cb29acd7cb2f4c8c509dcdce644fb44a0cab78046f79e668949f

SHA512
d1f3dfcf50be6ed607cb281ca5fb6f29331baadbfd00e8af633693ec3d0faf5d38835fe33dc99e883d6eba839a7976b71fc971f1299f14759182d9708682a110

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads