hook | a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664

Analysis

max time kernel
156s
max time network
151s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
14-03-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664.apk
Size

1.1MB
MD5

bf9bfd9b6139c92df74386c2e224de43
SHA1

c60ef6b00fd93ed7595b390b92d833e15edb8812
SHA256

a3b73640d3df40f8170d3dfb8457ec143aea6a3859daed3ba70b8ca416a98664
SHA512

259d880fc8516827c6be79fc9e11a91512b81a5abe282936988da7168aba0c7a7c0c466760d838110f54f95e84f72d293ee188b605a9cc9a33a35d837aa679d6
SSDEEP

24576:XogIZk2MoXAFVDqB3f3KgUX5Ue2s9+iEVj3nIg/Ss3:4gJ2zcdqZ3KZXL2ZBnIg/T

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5054

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e31b0c5778e1f301a86579a777c8bb22

SHA1
faa29b03944e4203a202edd0cb3bde4b620b77d6

SHA256
0cf97fc884da26681f2d030d6b2dd79088507f86b19ebb8bb98e7328dd8dd3be

SHA512
8c0932034a9f1e8acefde42e2a7ff1cb621c0d1aaf8d8646a127a0bcc066cea39baea78100ec15d00b3d809e289e5d78109aa093a298cb0d688dbee6132cfcb2

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
873c24fe85fb8c6447ea41a67ce7e835

SHA1
006e7acdfec41bb4805859247f9100436c52370a

SHA256
498f57758fbeb29190eddeb31f557a0d407e8ee55d3f1f85e1cc7ba2f8224c3d

SHA512
f29d36df6bb933c7b074ea69fd02b269c2c16b1d8ecd0ac692aaa909f0377823497b54995ac4bcfbe02cb1222033183f6f5f4f41610f7e089481e181d93b3d98

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
1ebd657a16a7c608e4f6ac3d3c919611

SHA1
ec1a4f15e22ae168efd48fa8cb08c4846956fc14

SHA256
b35d55e577f4f6b57737bef0ad40612469545961a86a80912eb790816705b4ab

SHA512
dcee396a56fec90cc4c2a196f1f1cdd6af0502281edfc49e0b9d3d6c38c4973bfeab9316ce97ce4095a98493d3ae722521cf0a29de0b85efe82b62f416fb9b6f

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
33ea456f4b43e7d330dd5ef64493a61f

SHA1
f0970e9cb650d75d5c931b8eeae869a35c140cbe

SHA256
2bc7b5b415d766e476bf00383de5a208c949cec97d2a2f893f1cb3f4ab431fed

SHA512
3b81c7801bc26b033179931491552b3328f511ece8db3c7f35d474ffa1e655e76013c1c99e61f9b72c0fb2f768400b7d559ae23f12587715a59812d64e1ef75d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads