hook | a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664

Analysis

max time kernel
153s
max time network
146s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
13-03-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664.apk
Size

1.1MB
MD5

bf9bfd9b6139c92df74386c2e224de43
SHA1

c60ef6b00fd93ed7595b390b92d833e15edb8812
SHA256

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664
SHA512

259d880fc8516827c6be79fc9e11a91512b81a5abe282936988da7168aba0c7a7c0c466760d838110f54f95e84f72d293ee188b605a9cc9a33a35d837aa679d6
SSDEEP

24576:XogIZk2MoXAFVDqB3f3KgUX5Ue2s9+iEVj3nIg/Ss3:4gJ2zcdqZ3KZXL2ZBnIg/T

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5044

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
4ffea196e68b06c457261c084af37d9e

SHA1
cde763e39611b613ffbc0658c9956f033bc0d173

SHA256
8aa873a5504b26aaaee21e1167d9e4f1ffd9e6620a6e112ce09cc84b11ab1457

SHA512
34528085134afce403c6ef9a581d1ce0ba68decf690e774e3fd7b2740ef22824fd7affd91a7a6bb4d2b23a90eb97cd327ca6991223625734f53e66ad31654873

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
073638de03d4387097752aaefedca5b7

SHA1
3b53e898e09fd5d82a9176d4f9a5fc6df52a6044

SHA256
4fe60884d31e5835f2f3dd5f2eb858bac45215d923d1c2b606d59925b8973142

SHA512
2f4113f5fa4ee13ef865f6b3275fbaca6349c9d62f9548911cee9999c2e9b203d69f4a95536e6cd27385c0b67a0401015c93a8232749aa55a0cb8dcc81c74c42

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
bc5c18f9e031ccfbd97881d46e80afc6

SHA1
509dc95078f4624e569838850b8592dba3eafcb1

SHA256
781c1d9966e6deddf00238762ae1f6a78139aa3c5c5052df466913195575279b

SHA512
d44f18b0d97ba2c038dbfad4d1c324d56cd83d524f03b1dcc177087e5263a462c95a4b4564146380d6c27a3091ac6a440d419d646abdc6d9f246e0c6f50fb545

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads