hook | 3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453

Analysis

max time kernel
151s
max time network
138s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
14-03-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453.apk
Size

2.8MB
MD5

db6463dca0973bb704ac9fce68a1dd23
SHA1

c35ffe6ab3797981da3b8fd830d4d0b3f3b24e2e
SHA256

3ee0b5f142884ccd460b619f7a536b4c68d0d649e34ce477cfe97d18b9620453
SHA512

bdae2fe17fb616a22c8559083e30d23ae5030923bb3dd95f7bab6e7ba38d19a22fa3140048f6cd222b2bbdb5087c7b9524fd695877734b3f64c5c809144f4fd8
SSDEEP

49152:9OcwHfICXpT/JVb0Tnb3fj29kgzpWUYCHBSZyL1xB07DsiHDwJAC6lg/Go:cT/ICXlvb0/PjakgPYCHBSZC1XCYiHC1

Score

10^/10

hook collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

hook

%INSERT_URL_HERE%

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
PID:5118

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
364383e591ac5386d4bd3450ad65899e

SHA1
200aa54bb14ac3fbd5aba5c262e7ec258a2e886a

SHA256
438f60d9989c7ccf3970819997d4d47c346f212a708e4c520baf4caf00e2a7c6

SHA512
f139022e8cf83d9626acf58c7bccdc42a7cb7927f91e0dff82ae5fbf57e6d47430a05637e852f5399575462211a498b75a13cfafcae80a9d0f0b8b41f7878c42

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
21126acd7053dc4e378eb2bff33bf517

SHA1
d6e36400d68faa8f9336567d85bcde6febc775a9

SHA256
49845d9a8d76a563e5d772bdc4fe297830708cdde0c8d3f01e1388a718fe6410

SHA512
8b34c3943e4b33eefed1655c3f672db7739651bfa0683c7c1958e27bc3b6c016afa9b1e782501d83909a9466f3dbe1b665a3667e9f1e2b92ec9f93ce1d5da98d

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
c29fb8b0f27f2cffeab04a67698b1cd7

SHA1
582ae16270fde1a56bd4aaba1768a1c067ee4a43

SHA256
29ad525a45954b56be70264b5fd36d8d31f1f7c41d5de830475dcc246058cd6f

SHA512
913069fabe7b28dec92312b5a007b139a3f5466b890f864518b27d5cde2581761202edc41f280ff5811cd7efe6f0cd1c72d4f9944e3d7e530b5c6fc74b26cc77

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
148KB

MD5
2b0d70e0ecf92aa0caa92d580d43f43e

SHA1
8870a51025afb9ef5002155cca20e8c5b9abefb1

SHA256
b48449c7178500e34aa2a79f1e1c5c3ccb468b8480d981fd2fdfe09478f25d6d

SHA512
ba0717089ba59919e451191bfdbd5ba4f7b3fde5888e595e83d095110592343b2ca03628ea836b408632888b1b750734fe0327711b49d627d5a26c8dd6a10cd7

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads