Extracted

• • Target

    2332e3ae6a6661124bb0c8950820008228b414164bdf285e6f72b21eb5f8a993.bin

  • Size

    2.8MB

  • MD5

    8ba409dc270b99a9d3cf027131f6a3e8

  • SHA1

    e1a56c0a7023aa3d046e04ce818a27f127986477

  • SHA256

    2332e3ae6a6661124bb0c8950820008228b414164bdf285e6f72b21eb5f8a993

  • SHA512

    acad52afc4e8dceae8e0202cbdf05270dec1ae136473fae3f7dd09c3ff26900c93ed0338da1f2a138abcace24693ce57ddd2c31a058befcf04dec0879c935d51

  • SSDEEP

    49152:OB2icoHtrPki1US8fId8R9Ra9MIoImb+o3dm3PXEA3hnoXivlzp/Xnkg/fr:OB2icoNr91Zr8BTIopbBNmf0ACXIpX5r

  Score

  10^/10

  hookcollectiondiscoveryevasioninfostealerpersistenceratstealthtrojan

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries information about running processes on the device.

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests enabling of the accessibility settings.

  • Acquires the wake lock

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3