hook | a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664

Analysis

max time kernel
151s
max time network
150s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
07-03-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664.apk
Size

1.1MB
MD5

bf9bfd9b6139c92df74386c2e224de43
SHA1

c60ef6b00fd93ed7595b390b92d833e15edb8812
SHA256

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664
SHA512

259d880fc8516827c6be79fc9e11a91512b81a5abe282936988da7168aba0c7a7c0c466760d838110f54f95e84f72d293ee188b605a9cc9a33a35d837aa679d6
SSDEEP

24576:XogIZk2MoXAFVDqB3f3KgUX5Ue2s9+iEVj3nIg/Ss3:4gJ2zcdqZ3KZXL2ZBnIg/T

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5037

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
800c9e6931658da40f5f0d2d078e02a7

SHA1
a05582cf27cbe065c14ab3c0e54f53e20c893987

SHA256
fdc419983bd2cd5d41e5fb28d61031d58027364ab2842aa8ca52989f4b9c4513

SHA512
fb1e1413a10b7286ce7ab8ccab88805ef801431168f0c01d4d0cfa2df1a9ec2c3273df60b7bb8366cd098a8c16cf7a5a342513aa7111d868b1203ac0a8a3be5d

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
9a2777fedc7084d5a8a0fab6541da766

SHA1
e5302829e45e25c6c407e7b9c66a7adde08b5804

SHA256
a164b651ef48cd4506379ba5121777dca613df64d984c0d70d450b0a6f652616

SHA512
3b43e9289fab14ea8e02e3c618be5809a7b6bef2b466a9a327a79522a7e229826483f658bfe5e54d0792a849d643922a8729997a046a4fad3c0db960cb022a88

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
1f6c099c1ebbce41ab50b9e25d4e88cb

SHA1
558591fe98c6c798c108586c66eb6b5012d44d0b

SHA256
657c1e4e8fe44379a4bfafb025288ecf1d7b6870f6d449c523f9ed8c16c10bd7

SHA512
e3a4e826d6a31c56b53ea21d7f2435622b8d603a4d61d84fd0d94dfd0600917a75ed8cdaa5cea44565b6bc9493f556cb15cfa2321a96fe0d5b2ca0e8f803b26b

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
592b738f3a51166a731064bd6dce53cc

SHA1
40f782d0cf80bbf137258d913e2ccc35652d4cd4

SHA256
2e7bf08f1a1f30352803bb5a227fb03c0d97ff76901033c452e3ac1d76370fc6

SHA512
564aafedff628c992df8174f63ce17866a7f6a70ee3eb55e1ae1a1823670e2fa36bda469e93c3d096350a23f986a55c7998735a705bc1f9228d344b78a84d3f8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads