TF-MAL-apk.hook
📛 Threat Title
Malware family: Hook
Description
ThreatFox malware family `apk.hook`. Printable name: Hook.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.hook
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.hook
IOC database
- Type
- domain
- Value
apk.hook- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.hook
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.hook
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cyberpress.org
Hook Malware - Zimperium's zLabs research team has uncovered a significant new evolution of the Hook Android banking trojan.
-
web:github.com
Mapping Malware with MITRE ATT&CK is a detailed research project focused on analyzing malware threats using the MITRE ATT&CK framework. The project investigates Ryuk Ransomware, a notorious malware family , identifying its characteristics, motivations, and potential targets - MojithaR/Mapping- Malware -with-MITRE-ATT-C
-
web:malpedia.caad.fkie.fraunhofer.de
According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene. It provides WebSocket communication and has RAT capabilities.
-
web:snyk.io
Shai-Hulud NPM Attack: Remediation with Snyk — Walkthrough of using Snyk to identify compromised packages in your dependency tree and remediate exposure. Summary: indicators of compromise ... Community-maintained detection scripts: GLPMC/Tanstack-Worm-Detector and omarpr/mini-shai-hulud-ioc-scanner (please do verify before using these, though).
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.microsoft.com
Users should also follow the mitigation and protection guidance provided in this blog, including disabling auto-updates for Axios npm packages, since the malicious payload includes a hook that will continue to attempt to update.
-
web:www.netcraft.com
Key data This article explores Netcraft's research into the HookBot malware family and associated attacks on Android devices, including examples of: Typical HookBot behaviors, such as the use of overlay attacks The types of brands and apps being impersonated How HookBot utilizes Command and Control (C2) servers to continuously evolve A builder tool that enables threat actors to develop and ...
-
web:www.researchgate.net
Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...
-
web:www.sciencedirect.com
This publication presents a thorough forensic investigation of the banking malware known as Hook , shedding light on its intricate functionalities and providing valuable insights into the broader realm of banking malware . Given the persistent evolution of Android malware , particularly in the context of banking threats, this research explores the ongoing development of these malicious entities ...
-
web:www.threatfabric.com
Hook , the latest project of the criminals behind the Ermac banking malware , adds Remote Access Tool features, allowing this variant to perform On Device Fraud.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.