hook | e80466cb3c64bb1f3881850075cbede72100a839648a92cc3f54e0d7329293ab

Analysis

max time kernel
56s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
30-06-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e80466cb3c64bb1f3881850075cbede72100a839648a92cc3f54e0d7329293ab.apk
Size

1.1MB
MD5

ff9737b946e5e2fa2053ca78de519123
SHA1

f2a4c97c103b7ba062b23a640ea016dc3fe71095
SHA256

e80466cb3c64bb1f3881850075cbede72100a839648a92cc3f54e0d7329293ab
SHA512

ce3106ce21398c3511995f1aa48ed514ab5537e3fbc9983cfc54fd975091d20c7cb2d38116459119a7f2419988d5b876d4e7cdbaf56743f01be34127371f8328
SSDEEP

12288:zyI9TZhXWwJ5eXYW/+dOpwyz6x3r+TgdrhuzKe2/6Aaak6h4PgUPbvbHTu0Zop3D:zR9bnuGgKV9inPY6gUPzXojpItg/gpVC

Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

AES_key

Signatures

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Processes:

com.tencent.mm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.tencent.mm

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.tencent.mm
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Acquires the wake lock 1 IoCs

Processes:

com.tencent.mm

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

com.tencent.mm

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.tencent.mm
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.tencent.mm

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tencent.mm
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.tencent.mm

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tencent.mm
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.tencent.mm

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.tencent.mm
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

com.tencent.mm

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.tencent.mm
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.tencent.mm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tencent.mm
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.tencent.mm

description ioc process

File opened for read /proc/cpuinfo com.tencent.mm
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.tencent.mm

description ioc process

File opened for read /proc/meminfo com.tencent.mm

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tencent.mm

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.mm

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

description	ioc	process
File opened for read	/proc/cpuinfo	com.tencent.mm

description	ioc	process
File opened for read	/proc/meminfo	com.tencent.mm

com.tencent.mm
1⤵
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4259

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/no_backup/androidx.work.workdb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal
Filesize
512B

MD5
6f7bb17c803bc74d8529d4e62a0705c2

SHA1
5d2f0f1cfb0aaa6018dacbe2186bbf7d97c06acb

SHA256
8c585c5b96b08809d91ebcf0a8c5d1326485ba5d49840be21937d68c3a2b6801

SHA512
ac88d72870277aadeb3666f8b501d211cbaf033562149a82382a70d5592ec208f10d3a9b7e1b88ed655ad86ecdb359e54d9ac8e11421c715f137fc224fdf502a

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Filesize
16KB

MD5
2e8bdf4d969f1b6490501481d8fe03b3

SHA1
5075718858607ebad3d79df37e2ce00c82156019

SHA256
a51ffce7bc5a8f6e4ced8224b093ba067a36c611e9dbf59d01b0ccf4ebecff0a

SHA512
20ea8d4b2db30fbefdf2a7c9972a5e0d466604a1af8fbd2834fdecbe1273e169c8671bf2f8aa01cc4abc592dffeceb6fd6991b4ed6ffdf0176bb542b489b8356

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Filesize
108KB

MD5
96954253835d3959f4628ad4ccb21324

SHA1
935346340a401ab5ec1570053a000e9681f044aa

SHA256
70296576601c39bdae83209a84ee071bd82d7f58e60f2bd42b06c5b389d0d23b

SHA512
3a82cb8bd3bc771513074e051750f5af8a7967719e5bdecbf9b12203a0eaf1978eeaed00e2e75589ebe9a84e59dd3957279324dab63a0a2fd26e4011fa88f7ee

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal
Filesize
173KB

MD5
f3d141cb1d710c4a3e7a289cbfab08ff

SHA1
987ad3356a20abb90a94fdfb7f2d37ccb83ba944

SHA256
78d4c194694c03f20115060571df8ac5a7d86728f27d15cfc323991922af33fe

SHA512
55a2d89de71058039be308ddd7683d393cfda35e513aa08cce145f599dd5bcab7b2fdc565bde4f09485b3c22ab5c6447e12ea42561f99b4b89f6cceadf8fbb6b

Download Submit