hook | 0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f

Analysis

max time kernel
155s
max time network
160s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
07/03/2024, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f.apk
Size 3.3MB
Sample240307-l9vwtaaa2y
SHA256 0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f
MD5 8d958576257733bd78fe81f84e768ed1
SHA1 cd19e464b30b42d80a532cd994828696dc5f7b9b
SHA512 9352203c5c06e69a2521041f3eb4751af80295ac50828b3e6a7d653198e6fb4db671b2fa214e3e3c166cf2a4c22ef54a5e87e40d6ce145a32a5c23b71a487683
SSDEEP 98304:TAxM4GZm5vjgae1B4IIDjl5OMxeAPuYXv+r5Pd:xZwMaQ4ImlAYeQuYXv+r5F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

http://77.246.108.116:3434

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5083

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 7f1d65174b7072b16a0f74018a9a9b704881b0ceba052b7df7b7904dab65ed37
MD5 84d5efe02db885b02687dbe4ac0b344e
SHA1 23dc5a7b16f610b08169e51e03f40123e5798267
SHA512 402f3dbc5f6ddab43d9c79d5736b9f056c43b012b6c57d4e57c691e444fa5f5d1b0bcab5634adb12bb05b1c3a19bcd9c226af563982bf2855dfe6d36baafbd50
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 ba2aee1dd3e11b55dbe00f77b49cf3208c4e91c8e25018c0fc44275a1f37f9b8
MD5 5010d82127fcea6c5581145c4ce0c199
SHA1 889f0bb7afeffedb495b26bf8abcef9ebd586fad
SHA512 2d9a7084ce15ed268da28eb8f99d138eee2c8a23a6eec26c6c1ec5e45d8a5c9955fac5bb7a4d62d7cd50e497353c09bb598f571e08b13b625a075ed19b635f70
SSDEEP 6:KNlHc1g9FZdrlOERX4PBX4ogLugMBX4suuK+/X9TJhSViOw2:KvHXzdTRmBEyPbP/X9HPOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Size 156KB
SHA256 5c9b785446c7b352d1634f80bedcf07d4be93ac7ceb5989dafa1c8d7956c67c9
MD5 a6357f6453df617bc7e47fcf6e4c3c93
SHA1 300fb93c4060b58d310a21bffdda420db0889379
SHA512 507937fbf7c0aada9d83698cb93ce9a790d4dcadd3b37022840b21c6ca3ca1bc56cc751fd3bfb69951f606b5515e6cb29f585db596c7ab69abd3bf60d9101d67
SSDEEP 24:tpJqyYfAJ0kLDJ0FJgWJ4JKqUJvwnJI32JmpJqyYjp+:tdYWLyawptdYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads