hook | dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7

Analysis

max time kernel
157s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
13-03-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7.apk
Size

2.8MB
MD5

4e0e33d1fa3467cd88e4ced9cdea8077
SHA1

3ddb1492fef6b0951c172a307f759f3dc962e2a0
SHA256

dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7
SHA512

8a91faa21cd9b67103b8ac445d36c698f7d729d7704c8d61407cf1a8612ff68dae8c1c4ff23c73fd82c4090ef82de688a10a5b38de1f0f06b2133d47a73e0978
SSDEEP

49152:Pi2q5Mqa4wh8vEZLi5APc/fbmFY8wGfFF5R2o0Rnw0rw2pl3Ft4y4X3wmAC6lg/q:alRavrg5APwbmFY8wGbD2o0lDw2f34RW

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4407

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cac894f5ee6e15203d65abba552a2f87

SHA1
85de1fe49d035a31a3fb5fe9d31a69b58c4415da

SHA256
054f0b070277468083bfb8bf3a44bcf0c53551f41f32fa63dc67099a99b85de3

SHA512
8e1248c983a70138918c918eff4efaf761b4f9f6092189eb8793e82f83c2d0b15c13e8e4d91de2157a40c5520997f591a924101693c8029da2e870d7a7ca19f6

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
399dd81179de88ed38cf50cc0b949e1f

SHA1
f8fe5d6ff514810e5f7c5fe77598135f175407aa

SHA256
36facbccbf71ff005908305e09f125b233b86fead19f05f720515413895cd0a2

SHA512
b8ca521792ea303fa647d95ca6f656485409f5b5bd01999c47784210f6b4f841b472f5e38317e6264076afa5a9699a605e5eafc97f5e2bf8e8dde449d97270df

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
1b3ef0f13c77f4bc272608d691a72c20

SHA1
3fb0e79eaeff7374840c788dfdc04f308c19a0ba

SHA256
07b9a5c4aac6d9f5e80be698f69a2eacdc0db6394bcb673652e4393bc7962f09

SHA512
fc4dab4c3f752bdabc71c2dacd0b8c9f9323705210649cbcdeda27486438a14f68d323ce0204d584b1c91141d40c0beb4691030f564b7d5c8af72a5a3e6e85c9

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
a8bdaea71bf2173d07268470aa21c1b1

SHA1
e770ec130f70d4c92b00b0b47105e9c64e2ae771

SHA256
edee3ede6d6f4e52754d9ac86143c0c80e23f1ab0a5f61f7f9021bc1e31bb10c

SHA512
f117152f916f26693699e6fe29205d28969a933828576c851515d3b1dd9abc93b1f7233010c870d86b0bc1632035edaea230c4dc48a5554800d61bb394814be1

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads