hook | ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

Analysis

max time kernel
150s
max time network
137s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
07-03-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.apk
Size

3.6MB
MD5

5d391a83a4c4f2e11bd9af3fce04118b
SHA1

1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11
SHA256

ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff
SHA512

d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27
SSDEEP

98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://127.0.0.1:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4997

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
92b86ab65d9ee171020015a9d77a2c52

SHA1
668c750e9e08c0de7d92585c5de0ad8f4e1b99e7

SHA256
28706eddebc2be5252afc8c53297027008551d9203a81e5a061fbed840e30406

SHA512
59f84f212dd607f7f13e8cfe446c788eadceaf9130750600a5f1e44c9b0804592ff59a29f3156767d5c4f7bf20dc2536cd0646a94d8f0d4fb1e93ea24afdba40

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0ed6527d091fbfa01db1dd9b32f53532

SHA1
cb20d755871d5fde856c157921e641940501a34e

SHA256
c10c8d581af69de7ab9cb7f1794181751ffde813cf0d083d1f1bafe35d4e3c5d

SHA512
5b3d78f2836cfe195777178d82af109ae01960f49f850c0acf41ce0c6cc9749bec0643195b47e8ef4b00bbf3fad757c3f0c859054281d60a24cbc1827a058b98

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f22d21350463bba7a6ce7a8139b5fddd

SHA1
30422a6fd60505b096df2260681239d624fb9301

SHA256
8f350e37de36d63ecacb637fc94e66ac05c2ff8675aeef440a071f79ef682b88

SHA512
89f6dc2a8b6258c585808bf6afeedbd6f33a04a1a39208d22f663ea6613110795055e2c26191137d7906ff9364a59b041304fdcafd3aea377122cde6755f8416

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
01c35c43faad576ce597fc97e4dea673

SHA1
1490b542005bac726808a644c8526a6311b08dfc

SHA256
c653ac44071a38eac7a50bee77e6d7e495193a05ce8eda0a26960978e6ab6fc1

SHA512
7e4b58a59ed8072712d2f697a28c74614137ed89d995c951eedd8f57075e914fa73635a974665f8f8612cc535e6ca27d0fd743c00543afca884eb8166a50ed77

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads