hook | 8d20189cd3865e13ce0c943b72472600308b40db54080c45d6b84117b69a6d52

Analysis

max time kernel
156s
max time network
155s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
13-03-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d20189cd3865e13ce0c943b72472600308b40db54080c45d6b84117b69a6d52.apk
Size

1.1MB
MD5

f6c6e7b69ba6026646d229757a7c0dcd
SHA1

af240d54bc5c9f31646da0a220e0679b0acb194e
SHA256

8d20189cd3865e13ce0c943b72472600308b40db54080c45d6b84117b69a6d52
SHA512

b0220f3171cda248a3306547c58fb52323467553cca7290e1c3ccb78855b4244b1c45576508f42f86c76c1352dbf5148156aa62251320d07e6bb7346cbe2c2dd
SSDEEP

24576:NUlxsCIH/aelw2APkxE5ecT6AEVj3nIg/SsDl:NmxsfaAx+kMCBnIg/1

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5086

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
782eed70d4c0a13894bab85b1f16ca80

SHA1
9808ac1d59f93da93162a7e6deda1dbeef4f9af3

SHA256
628a0bb16c7fef070dfebbd7bf838057db2ecd1cb0d0238dab55a7488277b504

SHA512
7b3399594e160c4eb40d0934771c94915fa195e16cdafae5bf3057b5eb2801cf11d2b82e90c5c58ecb52514d3ce12f1a70460731191cbb7aa271037505f451dc

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
8e9b1662bddb0ba8a5a273bc3e14a31a

SHA1
7a22f6903b70f89725e36cc147ac096e7be8c008

SHA256
573074eb9b814d777ec54e3919dafc44788c5ff566d3df28b19da0dbc0b023dd

SHA512
12209075a55ed67f18dfbcb5bdc15de984e1d28cf2d4a639a101c03298e2f7c6d9bca6b04469b53cdcc7b1d275a3c785a8184cc149a18b46c052522d46e245ac

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
ad04b12556e2adf25c09596e01ea4f49

SHA1
771069443479ef49c33efb77e45eb44f37b88a4c

SHA256
e253041a88877b0d2dee4673b91b27f6d10e89bcfc89f50c68d904ff66ed5740

SHA512
52cca0c094bb6a5f09fe93b8bd95e7fa0a44eb0962cf0d710fe60fd3f74eddbe1b760f2130656418b4eca46a29e25cac4413be799d7bb154398577286dd9d9f4

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
2372707a23f0106d49ef75dc48af8bea

SHA1
e5a8d69017010a46b9fe16dff9b026aac27c73a2

SHA256
a61546c2422a4eddf25a42547fcb239b37e2e1d318a751fcc5b2bedeb811d66c

SHA512
9a607178830cf384997e127969e04c95dc4225052a9c2eea5b962f9c35bc14fcb9b41b62e98cc0b6d6bdd8ebee534baa82a7d0f1a268ffeffcb4c1b9c377ed3f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads