hook | dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7

Analysis

max time kernel
147s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
14-03-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7.apk
Size

2.8MB
MD5

4e0e33d1fa3467cd88e4ced9cdea8077
SHA1

3ddb1492fef6b0951c172a307f759f3dc962e2a0
SHA256

dbd8366157d0bbc61a55335d95f595882611ada6ae0acefdd344ec40eba8e9d7
SHA512

8a91faa21cd9b67103b8ac445d36c698f7d729d7704c8d61407cf1a8612ff68dae8c1c4ff23c73fd82c4090ef82de688a10a5b38de1f0f06b2133d47a73e0978
SSDEEP

49152:Pi2q5Mqa4wh8vEZLi5APc/fbmFY8wGfFF5R2o0Rnw0rw2pl3Ft4y4X3wmAC6lg/q:alRavrg5APwbmFY8wGbD2o0lDw2f34RW

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:4596

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
e53cd288b80c3166da82dd6e3143e452

SHA1
26c3129d337f625198d021b049a58b3515986ae6

SHA256
c3b36bb72f5e57ae9c0b0bba3c755ec15476d9c3787752ce681783dbac8f0295

SHA512
49c7c3441c54be25409a24fad1d8b07695321dcc3420be275cb628fe8a0a08d0e763f4fe8e7bf4a98b51d2780baae00c1ede042b82a86a889933f98af94a5623

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
12c97f5c56a1e12c9af54f63dc39d499

SHA1
a65bac7d8aee3fa7793a0841bdf67b4497259c7d

SHA256
b5b2b789ac29ab829cb61617e6197872ff7a570d903a15bf8233f097c318a3f5

SHA512
937a6ae30a1724ec3f1fd537ed0549f3efee0e877213712f84204c7207b786f0c4bac158bdabd699d3f87356c1b045d8ff26123aba0c0da08b85b537dacb85a7

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
baa17cea55857ff4963880bf7ff00b12

SHA1
fbdfd4a6dad1abc6d2e28aeb99c44d0159cdc828

SHA256
b326287c2d980cee5bab4e218beabff3d4da3af165eec102f073183ebc2f9b58

SHA512
8f7a857f1af51e6fcfcdba9b85851ce08386cff64bc02006bb7d5352e167a71dacd5f8f96a2e52888a2e92c0c690f03cf910aa41580afcf55e4efd03cd43d87c

Download Submit
/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
27e5ee82d01c99b661faa6850988db7b

SHA1
c9a5b9169e3490a2f0085b94912bd6dfc93b2db3

SHA256
eccce39a80501f1889daefb36a10f45fdb8daf0921d2cc8b9c036772fcccfe7d

SHA512
76323772570bc74e589c539ce17aa2f0b83e08b6bb86b49c5727cf31747599f3785e5d107eb97dd0b35c04bc9f7d4341ca782d6406cb93cf0d7c5a4e3ea1a77c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads