Hook Android Malware Adds Remote Control, File Access and Spyware Features
Summary
ThreatFabric analyzes Hook, an Ermac-based Android banking malware linked to its original author, DukeEugene. It adds remote device control, file access, messaging and location surveillance, alongside banking-fraud capabilities.
Key points
- ThreatFabric identifies Hook as an Ermac development and attributes it to Ermac’s original author, DukeEugene, based on his public promotion of the malware.
- Hook uses AES-256-CBC encryption and Base64 encoding for C2 data, and adds WebSocket communication via Socket.IO alongside HTTP.
- Accessibility Services let the malware remotely interact with device screens, including simulating taps, swipes and text entry, and taking screenshots.
- File-management commands can list device files, download selected files and retrieve images.
- Hook can target banking and cryptocurrency apps, steal wallet seed phrases, log or send WhatsApp messages, and obtain device location.
- ThreatFabric says these additions enable a fraud chain from infection to transaction while extending Hook’s capabilities into spyware.
Article Details
- Attack Vectors
- Hook communicates with its C2 server over HTTP and can upgrade the connection to WebSocket; the article also describes HTTP polling as an alternative.
- Hook abuses Android Accessibility Services to interact with UI elements, simulate clicks and gestures, enter text, and conduct remote device-control operations.
- The malware performs overlay attacks against specified applications and interacts with financial and cryptocurrency wallet applications.
- Hook can list device files, download selected files and images, and capture screenshots.
- Hook can collect location coordinates, contacts, SMS messages, and WhatsApp messages, and can send messages through WhatsApp or SMS.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]233[.]196[.]2 | Hook C2 host listed in the article. |
| IPV4 | 5[.]42[.]199[.]22 | Hook C2 host listed in the article. |
| SHA256 | 55533397f32e960bdc78d74f76c3b62b57f881c4554dff01e7f9e077653f47b2 | SHA-256 hash of a Hook sample listed in the article. |
| SHA256 | 768b561d0a9fa3c6078b3199b1ef42272cac6a47ba01999c1f67c9b548a0bc15 | SHA-256 hash of a Hook sample listed in the article. |
| SHA256 | 8d1aabfb6329bf6c03c97f86c690e95723748be9d03ec2ed117376dd9e13faf0 | SHA-256 hash of a Hook sample listed in the article. |
| SHA256 | c5996e7a701f1154b48f962d01d457f9b7e95d9c3dd9bbd6a8e083865d563622 | SHA-256 hash of a Hook sample listed in the article. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelHook can send selected device files and images to its server through its command-and-control channel.T1071.001 · Web ProtocolsHook communicates with its C2 over HTTP and can upgrade the connection to WebSocket.T1417.002Hook interacts with cryptocurrency wallet screens and logs seed phrases obtained through those UI interactions.T1420The fmmanager command can list files on the device, and Hook can list images before downloading selected files or images.T1430Hook obtains the victim device's location coordinates when requested.T1513Hook's takescreenshot command captures screenshots of the device.T1516Hook uses Android Accessibility Services to simulate clicks, gestures, key presses, and text entry on the device.T1573.001 · Symmetric CryptographyHook encrypts C2 data using AES-256-CBC with a hardcoded key before Base64 encoding.T1636.003Hook's getContacts command collects contact names and phone numbers from the infected device.T1636.004Hook can collect SMS messages from the infected device.
Threat Actors
Malware
CerberusDiscovered in September 2021 by our researchers, this malware family is a spawn from the infamous Android Banker Cerberus.ERMACIn terms of volume, ThreatFabric observed only one other family which was comparable to these two: Ermac.ExobotCompactThis space was filled initially by Hydra, and in minor part by the latest variants of ExobotCompact (also known as Octo).HookBased on the malware’s panel, we named this malware variant Hook.HydraThis space was filled initially by Hydra, and in minor part by the latest variants of ExobotCompact (also known as Octo).MetaDroidIn this sphere of Ermac forks, ThreatFabric identified botnets such as MetaDroid and OWL, created from the Ermac source code and presenting minor differences.OctoThis space was filled initially by Hydra, and in minor part by the latest variants of ExobotCompact (also known as Octo).OWLIn this sphere of Ermac forks, ThreatFabric identified botnets such as MetaDroid and OWL, created from the Ermac source code and presenting minor differences.
Products
Androidwith the slow but steady disappearance of Anatsa from the threat landscape, left an open space in the Android banking malware market.WhatsAppOne last interesting addition is the “openwhatsapp” command, used to open the social messaging application WhatsApp, and allows the malware to log and even send messages via this application.