hook | 2b1ec76a384f7352d7efdada26eadac55e2cfb15bf3f0f6b93e5b0ec7a5e9755

Analysis

max time kernel
48s
max time network
143s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
09-03-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b1ec76a384f7352d7efdada26eadac55e2cfb15bf3f0f6b93e5b0ec7a5e9755.apk
Size

1.2MB
MD5

74c85bba05db7cc8c8d4ba59bd8d6466
SHA1

c64203af82bc4a194a337e379b19d07060dea054
SHA256

2b1ec76a384f7352d7efdada26eadac55e2cfb15bf3f0f6b93e5b0ec7a5e9755
SHA512

c04bcb67427880d7dbc3c404dec38853012e3e91c4633a2a5e7f9d4f8ed9bbb5204a0106f14f399ac3c7ab3198120df3a2272265a67718375a86250c36518c3c
SSDEEP

24576:I23tyREyhg45RJiL8s5F71kn7OH41ZJLgSkDX:I23Wh15RJiLvJN2zgSC

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kicozapiruxesati.tasulu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kicozapiruxesati.tasulu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.kicozapiruxesati.tasulu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kicozapiruxesati.tasulu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kicozapiruxesati.tasulu

com.kicozapiruxesati.tasulu
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5032

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
4a4c72705673f1404a6a2400c0d510a7

SHA1
a094c27a01ab0ab4c46f8f7265ef751b4629d0ad

SHA256
3308e03c31384bc7e85b49adbdaf92a95ad3c3252d2059088febc7d3214b68d5

SHA512
181409c822962f236369665786cda87069ea03d2cb7996434a4bc7e2de72a8c9f0a3cc7224b34f89aa7c4013dc6cf83bd76b23f27ddffd1abd52423951628c18

Download Submit
/data/data/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
09cf1d67b1a8a3fa3e1c6a6e2eea896a

SHA1
3b30b37ad9a9f0797557d2b7746ca39c397cf327

SHA256
260215868c405a5e5843ce8e59de64c04c5ce694eeccbce1d715c9fb27860501

SHA512
95e457155bf85d37f8c97fc74311ef0482ce511416e15f5a0c71f35be193f25d4d18d404e40dfe82920e010b2be4320bff42b7f0b57b029b4e3f64066912f4f8

Download Submit
/data/data/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
ae21f0ab519f43171d1ccb68df0a236e

SHA1
84542b027fa3cd50caceea5265aca93d633785c0

SHA256
270247d6191b8362dc4944848e8060a625174abbc8ad4fd674dbdebb42cb6ee3

SHA512
034a161b793c319f92f239ee557e19e4235b32dbcbb262cf50426db14c1778ea1781cd6d82f037fd27a1249787893f0cd9ea623a1412c39b11dbc154987617e7

Download Submit
/data/data/com.kicozapiruxesati.tasulu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
2dfe04836f0b1e8df898218785f93348

SHA1
35b5eb8dc16fcce895437e03aa9e0dda18d2c2ec

SHA256
c6ac0e5435670e8ce38232020416c6248de5d1b4f616fda2fd6a3dd36582e408

SHA512
0cb130f21f2b5f42686e4d8881efae62bd9232487ab3affa7cffe52c8cc7720197937c128eba5ca5bd1bb6072f2f9f7e3f873ed746f18fc0c01d78b7d407aa1b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads