hook | a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664

Analysis

max time kernel
148s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
07-03-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664.apk
Size

1.1MB
MD5

bf9bfd9b6139c92df74386c2e224de43
SHA1

c60ef6b00fd93ed7595b390b92d833e15edb8812
SHA256

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664
SHA512

259d880fc8516827c6be79fc9e11a91512b81a5abe282936988da7168aba0c7a7c0c466760d838110f54f95e84f72d293ee188b605a9cc9a33a35d837aa679d6
SSDEEP

24576:XogIZk2MoXAFVDqB3f3KgUX5Ue2s9+iEVj3nIg/Ss3:4gJ2zcdqZ3KZXL2ZBnIg/T

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4462

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
db1a40088f5086d1d4c87e927bfdfe1b

SHA1
07d922cad668ec48722267b2beba81b72ae16084

SHA256
d196dcb2922ab226fc3915c4fd963a0b801dae9e3fe34b1ef61c7e97674b8816

SHA512
5f2e954094d181d31eecc10872e584f00d86725e85c3279360243294be806c67e961c9b1bcf51a996906ac5f1ff1dc888d65c08a7df37e8260f55677a8d72a15

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
b2f138a3100b4750e43bab216ce72ed8

SHA1
4bb9a0454269084decc5e5da9c12d1698135d320

SHA256
80d61fd2050bd4fca39676012bdc854c0f8f5eb4285a5ef3b4f1bec233d53d2a

SHA512
d2e93a248316ca8f28fe6281a8d671f309e89a1fbeb4b9d56bf82f660730a715c84e8ba27dce4a571dfce5a2f38525fa3059b2d9cb88cc04c112a2c161d8eff5

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
e089d7c22136524a092059edf22b9f73

SHA1
06c0d70db00724b9c0481fc43571e01b3543a632

SHA256
537e63184663338a26e55fa8e5cea03aa595154afdd6a9bd0622c761574cc411

SHA512
4a4cd9cbd16c702df18954e2aeaa476dc14f2cf98767be308305a29d44ed8476564617f7163ed832e58356a1d7a7e265463f4a8cbd613ac7b4a7aee632ba9a39

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
30c68a1952fda9e2f398d01518b20bb6

SHA1
b596617e97a0ca349bc56f42710c8e0a0e4c7aed

SHA256
bca316ced7d4e61da3a8c23c5e29b3557a0e826e276188bf3933e17b2f57cc61

SHA512
675bf2f34157e9cd19dadea9e05b46520e14527d6fc9a5ac98b9210fb2b07454d481e467abc6a95fdf38e2b9c462fbb42dcae8e1d46aae7a89fa023caaff1040

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads