hook | a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664

Analysis

max time kernel
165s
max time network
172s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
13-03-2024 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664.apk
Size

1.1MB
MD5

bf9bfd9b6139c92df74386c2e224de43
SHA1

c60ef6b00fd93ed7595b390b92d833e15edb8812
SHA256

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664
SHA512

259d880fc8516827c6be79fc9e11a91512b81a5abe282936988da7168aba0c7a7c0c466760d838110f54f95e84f72d293ee188b605a9cc9a33a35d837aa679d6
SSDEEP

24576:XogIZk2MoXAFVDqB3f3KgUX5Ue2s9+iEVj3nIg/Ss3:4gJ2zcdqZ3KZXL2ZBnIg/T

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5053

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c82fed203f5a9c78eb00c2088a4b2abf

SHA1
c153715088496c43e1d30ffa0d6f7871743067c7

SHA256
7b3fd9067fc88d5d9d24ee3818ef79502e8f0d80f3749367d2e1e2ee2326ea26

SHA512
d107215f21318146ab809d29b7e4adf7b202a6edb200997bb75374c9fb391075c595bb466fb05b22c26e39c2411582d78f34b8e1bacb0b5f5f54851e3c35a845

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
48020f479c63dd4a387dee86729aa06e

SHA1
c8f697083b7f676af79602b063a531e99f02841c

SHA256
1fe319cdc6343c346d4cf79b04a7d2b72cdbec5b379cdcb5193cc9f96bf1c852

SHA512
a42cc0dd8d98d39bfe96fdcad9b08d45cc14446c8bde3903dad572eb5c0693e304a6105717e247c3b351e8368a91fb8521bd8467833d3b28fc9595f0622a815c

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
e9fad1552b23fc839a3ceb3fbe2f1929

SHA1
219913e7c7e6f996d09f0e400126651864a43676

SHA256
a4e6454eae6251812b784a98400c70d10e9fa919ae349351d0aa2b8fd5592a29

SHA512
be851112f8ba3a6e344ae20496ce1c2d825e2d67c035ff70a43bce33926e09918c604744d432f2691f8306f6e3f860f9d950286cc44be26c457eec7208c1a174

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads