Hook: New Android Banking Trojan That Expands on ERMAC's Legacy

A caller investigation of the Android banking trojan known arsenic Hook has revealed that it's based connected its predecessor called ERMAC.

"The ERMAC root codification was utilized arsenic a basal for Hook," NCC Group information researchers Joshua Kamp and Alberto Segura said successful a method investigation published past week.

"All commands (30 successful total) that the malware relation tin nonstop to a instrumentality infected with ERMAC malware, besides beryllium successful Hook. The codification implementation for these commands is astir identical."

Hook was first documented by ThreatFabric successful January 2023, describing it arsenic a "ERMAC fork" that's offered for merchantability for $7,000 per month. Both the strains are the enactment of a malware writer called DukeEugene.

That said, Hook expands connected ERMAC's functionalities with much capabilities, supporting arsenic galore arsenic 38 further commands erstwhile compared to the latter.

ERMAC's halfway features are designed to nonstop SMS messages, show a phishing model connected apical of a morganatic app, extract a database of installed applications, stitchery SMS messages, and siphon betterment effect phrases for aggregate cryptocurrency wallets.

Hook, connected the different hand, goes a measurement further by streaming the victim's surface and interacting with the idiosyncratic interface to summation implicit power implicit an infected device, capturing photos of the unfortunate utilizing the beforehand facing camera, harvesting cookies related to Google login sessions, and plundering betterment seeds from much crypto wallets.

It tin further nonstop an SMS connection to aggregate telephone numbers, efficaciously propagating the malware to different users.

Regardless of these differences, some Hook and ERMAC tin log keystrokes and maltreatment Android's accessibility services to behaviour overlay attacks successful bid to show contented connected apical of different apps and bargain credentials from implicit 700 apps. The database of apps to people is retrieved connected the alert via a petition to a distant server.

The malware families are besides engineered to show for clipboard events and replace the contented with an attacker-controlled wallet should the unfortunate transcript a morganatic wallet address.

A bulk of Hook and ERMAC's command-and-control (C2) servers are located successful Russia, followed by the Netherlands, the U.K., the U.S., Germany, France, Korea, and Japan.

As of April 19, 2023, it appears that the Hook task has been shuttered, according to a station shared by DukeEugene, who claimed to beryllium leaving for a "special subject operation" and that enactment for the bundle would beryllium provided by different histrion named RedDragon until the customers' subscription runs out.

Subsequently, connected May 11, 2023, the root codification for Hook is said to person been sold by RedDragon for $70,000 connected an underground forum. The abbreviated lifespan of Hook aside, the improvement has raised the anticipation that different menace actors could prime up the enactment and merchandise caller variants successful the future.

The disclosure comes arsenic a China-nexus menace histrion has been linked to an Android spyware run targeting users successful South Korea since the opening of July 2023.

"The malware is distributed done deceptive phishing websites that airs arsenic big sites but really present the malicious APK file," Cyble said. "Once the malware has infected the victim's machine, it tin bargain a wide scope of delicate information, including contacts, SMS messages, telephone logs, images, audio files, surface recordings, and screenshots."

UPCOMING WEBINAR

Identity is the New Endpoint: Mastering SaaS Security successful the Modern Age

Dive heavy into the aboriginal of SaaS information with Maor Bin, CEO of Adaptive Shield. Discover wherefore individuality is the caller endpoint. Secure your spot now.

Supercharge Your Skills

On apical of that, the malware (APK bundle sanction "com.example.middlerankapp") takes vantage of accessibility services to show the apps utilized by the victims and forestall uninstallation.

It besides contains a diagnostic that allows the malware to redirect incoming calls to a designated mobile fig controlled by the attacker, intercept SMS messages, and incorporated an unfinished keylogging functionality, indicating it's apt successful progressive development.

The connections to China stem from references to Hong Kong successful the WHOIS grounds accusation for the C2 server arsenic good arsenic the beingness of respective Chinese connection strings, including "中国共产党万岁," successful the malware root code, which translates to "Long unrecorded the Communist Party of China."

In a related development, Israeli paper Haaretz revealed that a home spyware institution Insanet has developed a merchandise called Sherlock that tin infect devices via online advertisements to snoop connected targets and cod delicate information from Android, iOS, and Windows systems.

The strategy is said to person been sold to a state that's not a democracy, it reported, adding a fig of Israeli cyber companies person attempted to make violative exertion that exploits ads for profiling victims (a word called AdInt oregon advertisement intelligence) and distributing spyware.

Found this nonfiction interesting? Follow america connected Twitter  and LinkedIn to work much exclusive contented we post.