hook | 9f48b10023f35097e883c7b02ba68166ea9412d2ec2684ca20c1ae38fbe42081

Analysis

max time kernel
52s
max time network
131s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
09-03-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f48b10023f35097e883c7b02ba68166ea9412d2ec2684ca20c1ae38fbe42081.apk
Size

1.2MB
MD5

0a1e564fd5962490e45bcb8d71ea6283
SHA1

ab113e8397243f6c6f86cc3ac3a7ff4546c5fa6b
SHA256

9f48b10023f35097e883c7b02ba68166ea9412d2ec2684ca20c1ae38fbe42081
SHA512

f9299a04668114168824e6bf7248a8b6ecc30e455b9a9bcff845e7d62018ff029f43e0f36f40f7a69fc8a9940cdb42bd153f3f81d327ac85ba3d84c9132a164d
SSDEEP

24576:Cz9XJxtkyhg45RJiL8s5F71kn7OH41ZNbgSkDXQ:Cz97bh15RJiLvJN2HgSKQ

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kicozapiruxesati.tasulu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kicozapiruxesati.tasulu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.kicozapiruxesati.tasulu

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.kicozapiruxesati.tasulu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kicozapiruxesati.tasulu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kicozapiruxesati.tasulu

com.kicozapiruxesati.tasulu
1⤵
- Makes use of the framework's Accessibility service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4405

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
1c3601a6cad4e4ef1c15adb949fc88f7

SHA1
7606de49ff688b4f129443406e7c4141649755c9

SHA256
66ded2d7339a1a61440052a2af6f06c441fcd6df685d1965703c834b04694ad4

SHA512
bb4068a9f8915fa5589753523167e7ce37725dcce3a838f76be3d91f9c48652d67ddaa713ac216abf6a9e554389f18dfb86b23783be48e4183387a210978817a

Download Submit
/data/user/0/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-shm

Filesize
24KB

MD5
91ff0dac5df86e798bfef5e573536b08

SHA1
ebdd38b69cd5b9f2d00d273c981e16960fbbb4f7

SHA256
de676bae28a480011d3d012db14bef539324e62a841a9627863c689bea168af3

SHA512
f9c2cbda26d1c3e32f54625b5488f7d51dbe59f6cb742ce98b5f9e9ced089e65327fc381284f7f287b513c1b860b6898a53ca46df3cc4926ba0eb339f3c29bd3

Download Submit
/data/user/0/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
94fbc915f04649e9840374564564a012

SHA1
11d474015651c3ad09b88162e5d6ab0fecfc990c

SHA256
751e374896391e9d4aefa24407d7de31c37a45e7583dc8ec000f63cca1f5450e

SHA512
f18aa71a1282b0ff9906f86f1a3211b45e91e9e6dbf397adf97bd1efedc6bd8ee14467d0f61080abcea7dd798cc0e74997cf529c0fa37a37f1624daa5ab2d0d8

Download Submit
/data/user/0/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
04489bac077abf189865048f0d802e5d

SHA1
ea5a74c3540638277cb4ac5efc963ebef4521189

SHA256
61b70487d89989c1bc85eeb17cbe80cefe980e4fd997d97eaf129778b46b978b

SHA512
8c6f679f179450620842b97435eee9b354ded7fa9c9116f7491a16c76d18538cdb5cdd9db97d4db61173ce6058e281a576288da137f9e01076a1c613000e6397

Download Submit
/data/user/0/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
eba0b8acf39343cafab988b1709db1f8

SHA1
abd683a5e52831ff6b050c0d2be00d46e04f8dc4

SHA256
f96c2baab583b5e05e8384c4e5345144d18b536a35950a02d30f5925f611d758

SHA512
3822a7ffe11fd18639cef0ce5cbf01751d0965db26fdddd62cb439995bb66383a115652fb2ea6c517983055bdad211c10fac4d983f22e330f43c89873342b0c9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads