HOMETHREATSHook
MALWARE FAMILY

Hook

Internal ID: apk.hook
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene. It provides WebSocket communication and has RAT capabilities.

Threat Analysis

Hook is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://cebrf.knf.gov.pl/komunikaty/artykuly-csirt-knf/362-ostrzezenia/858-hookbot-a-new-mobile-malware
→https://github.com/0xperator/hookbot_source
→https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf
→https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf
→https://info.spamhaus.com/hubfs/Botnet%20Reports/Q4%202023%20Botnet%20Threat%20Update.pdf
→https://medium.com/@joshuapenny88/hostinghunter-series-chang-way-technologies-co-limited-a9ba4fce0f65
→https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/
→https://www.sciencedirect.com/science/article/pii/S266628172400088X
→https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/
→https://www.threatfabric.com/blogs/hook-a-new-ermac-fork-with-rat-capabilities.html

Quick Facts

TypeMalware Family
Aliases1

Also Known As

apk.hook

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Hook
Hook — Malware Family | Threat Intelligence | CTIWATCH.COM