hook | 8d20189cd3865e13ce0c943b72472600308b40db54080c45d6b84117b69a6d52

Analysis

max time kernel
147s
max time network
146s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
14-03-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d20189cd3865e13ce0c943b72472600308b40db54080c45d6b84117b69a6d52.apk
Size

1.1MB
MD5

f6c6e7b69ba6026646d229757a7c0dcd
SHA1

af240d54bc5c9f31646da0a220e0679b0acb194e
SHA256

8d20189cd3865e13ce0c943b72472600308b40db54080c45d6b84117b69a6d52
SHA512

b0220f3171cda248a3306547c58fb52323467553cca7290e1c3ccb78855b4244b1c45576508f42f86c76c1352dbf5148156aa62251320d07e6bb7346cbe2c2dd
SSDEEP

24576:NUlxsCIH/aelw2APkxE5ecT6AEVj3nIg/SsDl:NmxsfaAx+kMCBnIg/1

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4247

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
05a3125a263ebfdb681a2a11942c9f65

SHA1
978d6dd87a0ed7e9dd0d6c541db132bb38ec4737

SHA256
5afd0bdd474e3643f63a894f8904a4fe044c85046b575fa912c88a5c902acec3

SHA512
e96d8274dee0bd226e9e10bc1d08bde3b024881e768919ab1f622ef91a094a869138a4df03e802480b48779d90add54892a3b0a814a07c14d05308921593c308

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2f6062ab9f154e347d14def94ff411bf

SHA1
85c9cfb127283758d946f92e8933c407cb84b08d

SHA256
88c10c8f32af523301370d967fb78d7a9dc37b25350ff757219acdf710ae76ef

SHA512
cb7d4a86156153c9122be135dbd6a3bfc0b121186bca3584c71cef7389a1c4df27157e33204be5072e02e5b919cecb74be4887a62f2a632ca7bee6a96800962a

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
5255356e9422c18f72edd1406e96ec82

SHA1
e35e5719ab14e574f89a59b8ca95c14e19cd3509

SHA256
938b32af09b127ed0c3430381fbad99ef8794a1948653b0e74953548a8a0bbd0

SHA512
acc821904267c7973ff8f5b58fea99976cc92d64f0d01db69e8453e5b28fcc35056ac64e988c27b0e94176bfa12a0d3a1f76023d302ca96f2120cb3851bba7c8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads