hook | 3c21e47c0430495ca819255c0bfde2d30d1e121dc09d174f3bf4d5797929f2a1

Analysis

max time kernel
25s
max time network
157s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
05-03-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c21e47c0430495ca819255c0bfde2d30d1e121dc09d174f3bf4d5797929f2a1.apk
Size

1.1MB
MD5

397d193739f87a3c4ed4a5fb9cf8f43a
SHA1

e30b5f0a984dc3200e55db689ed5defed5efaad3
SHA256

3c21e47c0430495ca819255c0bfde2d30d1e121dc09d174f3bf4d5797929f2a1
SHA512

58a1ad4e3ebd5cf7dbc82ddb6ec9acf00a25a62ee620c480e9ec4d329edbba0df3ad78d80b4eb11687687611ef55a522ac1dfe131a9667e841e97f72e92017a5
SSDEEP

24576:a6NKl7FvoGo1DMRaeq2lfnXTB2I3hmW3+NUr1ojXmhP07aUdg/bMpk:a6UD+DMR0iJhL+Ii2hPXUdg/0k

Score

10^/10

hook collection evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.google.bg
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.google.bg
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.google.bg

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.google.bg

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.google.bg

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.google.bg

com.google.bg
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4630

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.google.bg/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.google.bg/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
405143769e165a211740735b8e8a1713

SHA1
603f6e75cae0acf215a694522ca48c783e2716c3

SHA256
f0abb298e85c18c7318c29c648b0826a4d0093f24a741176f550517bd48587cc

SHA512
ab72eb971aad904ff6ae9a62660dddefc51831bc0e690eb16569fc1ea15baa0a5f385d839354225c4fee97fcd02ef28ea94d06f5db9852c7996317a7735739ad

Download Submit
/data/user/0/com.google.bg/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
82053350d38b1f0d2cad5436444ec537

SHA1
7aa0dab436283951e86c7c01d66c716eeca255ac

SHA256
ff5b6324cc9d3982050a817d0cbf6778aed4c98663d1a10dfc5510b538ecdb0d

SHA512
a5effec4d2731641566349d50e30d2a7465d54b79ab330f41adc7eeeee9b68413a5ef26707b0a07635fa9b6c528755d2795382144668933b1049d99d610ddd39

Download Submit
/data/user/0/com.google.bg/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
1e390546bbb44b550da6ababc6d96930

SHA1
69cc214302ae788b34e910f6194588be59ae1de2

SHA256
0b9e98bada67986557b2258d219a997191fb9c56fefb71b7b55a3ed771443acb

SHA512
4b8452ca113292ae36376eaa661947a6b89976c14d33f78484f7b389084477aa6a4a896240ab3b9933a2ca9a33515e0002a1e5c3a401a756a262ed3466461aba

Download Submit
/data/user/0/com.google.bg/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
1e42b0564719cdf07a56aaeb4d70f3f9

SHA1
f1201d2bb9080e23e5aeb8f81098e5d8f24bd76c

SHA256
ab04d8f4fd3d5fcf303fdfa9f692df68b2106e72b01802b8af91f5aeb73c85e3

SHA512
d7abed19bd57e48f00a5eecf70efc870ca6ead64a3d5fb13562a17f2992ecf88ceb0ae5fcd06f6d3787efdda1596b03556356fb76e9057e427487eedf996d73c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads