hook | dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7

Analysis

max time kernel
146s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
13-03-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7.apk
Size

2.8MB
MD5

4e0e33d1fa3467cd88e4ced9cdea8077
SHA1

3ddb1492fef6b0951c172a307f759f3dc962e2a0
SHA256

dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7
SHA512

8a91faa21cd9b67103b8ac445d36c698f7d729d7704c8d61407cf1a8612ff68dae8c1c4ff23c73fd82c4090ef82de688a10a5b38de1f0f06b2133d47a73e0978
SSDEEP

49152:Pi2q5Mqa4wh8vEZLi5APc/fbmFY8wGfFF5R2o0Rnw0rw2pl3Ft4y4X3wmAC6lg/q:alRavrg5APwbmFY8wGbD2o0lDw2f34RW

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4237

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a16975a6547d6f3cac2933469e08ab12

SHA1
3ef5c3be5235de1a7662e43f36d3e8d005e43834

SHA256
958c29db081946b2c6dd31735fdb98eded02dbb23d9b0b36b27aef6c1965c45a

SHA512
3af9a3269db27b7bb8754613cead23044567f12cebabdb282e9a9ee0a1b62c5cd157b7cc50749240202ded02ebc7fbb2d6363d2a665635cbac81386e19771e23

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
8357b1d8daa3a2770807ec84eefbaca7

SHA1
8f96fe1858df7df86c9976b838f46e538bca1875

SHA256
45fa2d227264a60d8cb019c58a03abbcd76c01862283b170588ca82004c55829

SHA512
d6d9b333edd4feec5cff0154c34f89359a0e02255a0689b4e3f1c3c234ce37356863bd3ca2bef03ba03a7c3e7bc368b11cc09d3a4e3568913103c2bb54394d7f

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
cd01e9b26ebf2b271302b227cf091e01

SHA1
d52b172ad60cf5e2e9a23702921e94c871d80737

SHA256
0f9a5ecd90d798a8e3f7930f3b183284c42b1b8fa1bed9aea8d47b063b7480e1

SHA512
318771f2e8870a6e1c9952357431ed9ad4b1fd380d749e86cf3d8c8e2bffd7dbcb81839d372c064fb01704bd2dba962ec1c88d7a66a9a9e02972ed4dd5cfc69a

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
dd9a67cbc4c6b15017bd7738842aa244

SHA1
60c6e8a12d5be7e46058fa3c203532a8e1df0be5

SHA256
9b4acc347f9f0c34b9f978b1439a3bd9a4acd9b4105277866be06ea5607ed52c

SHA512
d1ba0b9f9eb2513ad932a5e4357a3ba454aefb4bdcce07a8d070d8d6228d1ab3e8a6d64b0e1044cd4900fb91492ae1d400e3c169a155a34bab84e3171e1942a2

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads