General

  • Target

    b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2.bin

  • Size

    2.8MB

  • Sample

    230717-tek25adh6w

  • MD5

    c909a9df9dc4c6508eb4cf7c68aa5293

  • SHA1

    0adf0df2c56c8b76b27abde0e73d18bede6c8274

  • SHA256

    b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2

  • SHA512

    782e63f86e8662230dc3f22bc872ed54a8a4e8284f965c869831bf14ee2ce0dfb83a473031b4bd9579e205928211498c75e06182063fcf8c26ce6b254b16831f

  • SSDEEP

    49152:LTMV/hemABwhkqfbDU0g8fYz5mgzMTym95CFHnrNUlgocZFWy3ACdv3IFoBQ/g:LTk/zRbDU8Yz5mXTyuynrWl/cZco52Fe

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Targets

    • Target

      b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2.bin

    • Size

      2.8MB

    • MD5

      c909a9df9dc4c6508eb4cf7c68aa5293

    • SHA1

      0adf0df2c56c8b76b27abde0e73d18bede6c8274

    • SHA256

      b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2

    • SHA512

      782e63f86e8662230dc3f22bc872ed54a8a4e8284f965c869831bf14ee2ce0dfb83a473031b4bd9579e205928211498c75e06182063fcf8c26ce6b254b16831f

    • SSDEEP

      49152:LTMV/hemABwhkqfbDU0g8fYz5mgzMTym95CFHnrNUlgocZFWy3ACdv3IFoBQ/g:LTk/zRbDU8Yz5mXTyuynrWl/cZco52Fe

    • Ermac

      An Android banking trojan first seen in July 2021.

    • Ermac2 payload

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

    • Target

      cupcake.svg

    • Size

      884B

    • MD5

      9276b1d50989424f73e5a2c048aae439

    • SHA1

      5c6ade4aa38ad6e519e5143ab0dd5db616c93673

    • SHA256

      21ca474460a8860cdd9001cb81e6a4c21057ab1b8319f79b361f5f00e14e52a4

    • SHA512

      c2e2c01d8bc7b6ede75010bc37baa986a756e88041a08f9c9749abbca8c03a194f5f2bdb9f9a8f6ed2d3b24ad8316e79b2f87e37d34471a4181bc4ea188c1065

    Score
    3/10
    • Target

      default_paper_1.svg

    • Size

      12KB

    • MD5

      9658960830d456b89affd96265707a65

    • SHA1

      39db85b2a68f9f96fa568b81c19b15156cc245b0

    • SHA256

      9f1cf380d0fa625dabe9fea026f517d1872a4eeca02ed75273347f6c25aa7cb6

    • SHA512

      5ae4e9c5b05368fbb1cef7f9d54dc6b8589726a14e291858878179b2612f3be308b6f2c667975cdedf551d653f3fd62f48635464d909d79f07545cd868745859

    • SSDEEP

      384:n8+jVDo8rIih2YqCPkquAOjOPL274icc8:HjO8MipvnS7+c8

    Score
    3/10
    • Target

      default_paper_2.svg

    • Size

      2KB

    • MD5

      36cafbfd63e8774bf7863123e3e9701b

    • SHA1

      16207c1b628183cc8d116670253e3b662d186020

    • SHA256

      1798b882dd9dbf31ba3885ae6d1a415c79a2f8417d24af38fd3c97f2b8e00a83

    • SHA512

      3d933ebb2ff0f27548a8fd08053f0f165717aecc61f64ab56233fded015529d52a7a997d3d5ce7a6efb6354f6926f41a78edaa6b4fcb5ba4ded20f47ac0640a6

    Score
    3/10
    • Target

      default_paper_3.svg

    • Size

      13KB

    • MD5

      61dcabc92cbbc8c5a6b74459ba4b0484

    • SHA1

      61caf4885fdc4605dca55556a6b5846c2cd7cff6

    • SHA256

      59ab01e8027bc7c9b85658031d5c39f47e60fecdc6afb104c8b642874e704783

    • SHA512

      67b6d420eeaab4234bfafadd6d3c3cfc1587be865ac383f25852ce4ee7fbfbe32cd8e09e32c8c76df41bb3fd31c6c45d77d658aae1aace3c456186fcb0706975

    • SSDEEP

      384:nIoEOHXOHI/k3zygb2OrDC4C1g+845JPhSQ:I8HE3vxMJoQ

    Score
    3/10
    • Target

      default_shape_circle.svg

    • Size

      621B

    • MD5

      74d73099ae2a0e53764290c42496b48e

    • SHA1

      dd9675cc9771b06a9df6278f476fbf8d11c45ce2

    • SHA256

      28ed3f79e4b79171851f2415b22fe7411b778e5a819d80fc903d794fca58e363

    • SHA512

      a143c037ed878f862d028add206bb3d61baf4eb5486c0907bc41bfc5ef0fc30a49878e662369ea97a3d6ed4215f507ac304220c53291f2527f613e5cc82c2b4d

    Score
    3/10
    • Target

      default_shape_heart.svg

    • Size

      679B

    • MD5

      d042722236980ed9831030fa34b12285

    • SHA1

      b9639db7dfe552e159ee60fb27bbdcedfdb770c7

    • SHA256

      c045ccb0592752c40f2f26bfe321916970235675421601d90dd843ad7b5f5970

    • SHA512

      a3900bd479f48a4cc53864922a4438fcc15cb30ffd0227642f8420c477e5a4149f32c5dc7f364220336783d12f3d836b486936793c810ec7bafa4ea63d77d172

    Score
    3/10
    • Target

      default_shape_romb.svg

    • Size

      552B

    • MD5

      937cddd9c34265203047abffbccb830c

    • SHA1

      c108ffc515239cd448e278623450df7c2375c4a1

    • SHA256

      b7b74f49936ecf56d1d49de6b20ab0c7ac9bf128cf50224b4f8598967c9de228

    • SHA512

      0f25e183c57ef789569e7cc28b1c74efca5efe8a675afc809864191fae3586cea5f9ac18b506591fb1471f2e0a5cbcb4e0e070230f597fea992f7ffc0a719dbc

    Score
    3/10
    • Target

      default_shape_square.svg

    • Size

      532B

    • MD5

      ae0e2fda5b632161e8a4e4db3c3556bf

    • SHA1

      176f72f664d221a8a2e7429fa34adc1a719b98c7

    • SHA256

      dc69be436e99e3492d601f2742153ceb0956fc7e4327c74e75fff2897fe98489

    • SHA512

      3b4d30ed9024602eda8db5c13427b12c6f451d33de4c970b0bb90bc8665ac20d992723443128541d55fb9445854d6285c644e1edeff5004b413a24bc5d9d8830

    Score
    3/10
    • Target

      default_shape_star.svg

    • Size

      617B

    • MD5

      5408b4ac66d1730f81e48c2ac3ec27ca

    • SHA1

      41bd30ec87e98f20f6501502dc454659f60fee12

    • SHA256

      d61c5552c72ed7b1307753d1fead5f2a423d22a8342ec389285fae9a35834775

    • SHA512

      7a60f4597328c41d43c3fe73a7ab0856fc84d2fc6e6e6c13850b497a9bc67f27485eb1be6861afab476713d39480830e299373b4c4f835bbc2358b18806e47f5

    Score
    3/10
    • Target

      default_shape_star_2.svg

    • Size

      599B

    • MD5

      776463b990d030b4534f231501e81a44

    • SHA1

      2298ac88fe7643d4485f7109d45d910928940d60

    • SHA256

      a450186916b620ed8416a990263f4dd98ddba309bfddb68e8c80d780af5ccac1

    • SHA512

      e84fc31d6f61a760162b111dc7287503a553450ca9d10d9be1e4c3b4000423e78098e0e86e435bc887d79ae43e425bf38d81eb7c3dd236ccff689d22684dd53b

    Score
    3/10
    • Target

      default_shape_triangle.svg

    • Size

      565B

    • MD5

      89c3be1517c106f8777929c89462b9b5

    • SHA1

      42aaef047a9d0b2b831c4ea007a2ee8ec829b45b

    • SHA256

      c30dbce55577b2c831a5750af301547bac296c9f72317321115f8853354f3f1c

    • SHA512

      da6b3dfa996b154c472fed39ed3b18b3f7cfac011dc3243d189d2bdd09a2b022faaa4ca865941f47c800d9438cc17be1980dae60787fe741c12a5fb962cbcadd

    Score
    3/10
    • Target

      default_shape_x.svg

    • Size

      641B

    • MD5

      2c4cda2ea8fdd5e6b9ae73f74ba1c947

    • SHA1

      b9e94e7e7e7702ae39dcf5fbae881c37ebed6f6f

    • SHA256

      f40e3c6bbb8cde06b326f01b057caa646cbbf8b935447dfb45b4d2c00f385a96

    • SHA512

      474593d18d483ef32b73504acefdc4ecb12e3a220dfc5020850f0d319104f6148d32ee3255681134590bd9356e6a362633ed1c3ff9b16ca80bae849be176d529

    Score
    3/10
    • Target

      diamond.svg

    • Size

      420B

    • MD5

      2effe63f1f3ed1de34c13964e0ddc618

    • SHA1

      052b64d10a4703f3ef9617221834bac8ee954582

    • SHA256

      cd623d8f84a9bad0a1fe67dfbde5b602a0c01a796c165ed4b2baedc7a47ba575

    • SHA512

      88e71dd54c43b2b4b482764084637d251ab4ed7a65e74b53c765d59928a146bfdcd7a23ce4ec20421b449dc890b8b11baa430ec30f96574bc588a48c9f5f40ac

    Score
    3/10
    • Target

      drops.svg

    • Size

      1KB

    • MD5

      f3b7f2e9f57371f60ef0495ea248466c

    • SHA1

      b92219a7072ad7829eeda64e57a16b0126e9a943

    • SHA256

      25831a6ea5c51459a6351f168c9b479874e486189f13c97ec9ebf5c7a048bc5b

    • SHA512

      b5a7a2c2e2e7b78e82e1c411e8d1c74357cbdd40e0e643ff4ab986f561e32afa8c7fee6ba56f5375a8635e3ba60e014b51f0b1a2cc099b56f5beee497551a6d9

    Score
    3/10
    • Target

      elephant.svg

    • Size

      1KB

    • MD5

      600ae3fbd3363e633abd760dff8786dc

    • SHA1

      efb3df6437ec04c831de274ab26bce05acb9b7d1

    • SHA256

      a92ecc65206943469c3fa3cf03de7600645919915b95933f309e8c8bab39baa8

    • SHA512

      d5824310a5dc62b24a9e37e92982971d4c93461ed7f250182a7a757ba343c5bb34b1d0b7edf87756b7e70c46185ec6b4d3474ce0cff790896fba7cd3261d2088

    Score
    1/10

MITRE ATT&CK Enterprise v6

Tasks

static1

Score
7/10

behavioral1

ermachookbankerevasioninfostealerransomwarerattrojan
Score
10/10

behavioral2

ermachookbankerinfostealerransomwarerattrojan
Score
10/10

behavioral3

ermachookbankerevasioninfostealerransomwarerattrojan
Score
10/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
1/10

behavioral7

Score
3/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
1/10

behavioral11

Score
3/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
1/10

behavioral15

Score
3/10

behavioral16

Score
1/10

behavioral17

Score
3/10

behavioral18

Score
1/10

behavioral19

Score
3/10

behavioral20

Score
1/10

behavioral21

Score
3/10

behavioral22

Score
1/10

behavioral23

Score
3/10

behavioral24

Score
1/10

behavioral25

Score
3/10

behavioral26

Score
1/10

behavioral27

Score
3/10

behavioral28

Score
1/10

behavioral29

Score
3/10

behavioral30

Score
1/10

behavioral31

Score
3/10

behavioral32

Score
1/10