Analysis
-
max time kernel
376908s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
09-10-2023 22:00
General
-
Target
60a84a9c1f41257573d5c2ee96926ae56c2e7255b62526b432bff3818a95d438.apk
-
Size
2.8MB
-
MD5
7c71a0dfa8b60f6ef52f3d6c0c1d8f3a
-
SHA1
7eeeb0cd33994adb728fcbc8376666a9bcb63b74
-
SHA256
60a84a9c1f41257573d5c2ee96926ae56c2e7255b62526b432bff3818a95d438
-
SHA512
eacf91ce4fa315213b3936f95accc7cc7339e1cc1623cb67c9e8c52a696de9250ed2596c782ce55c8fb28ef8a1f7aa8c219ef5c371d4e18b5610b0edf8594f6a
-
SSDEEP
49152:jhl6sJ8552sjbU7g8d8qbdm0rwa5ztam7D328ugZ4e85W3/Az:jhlCdjgwqbdmIrXrr85R
Malware Config
Extracted
ermac
http://91.215.85.37:3434
Extracted
hook
http://91.215.85.37:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.zeriyatetahelo.hodi1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
677KB
MD5853bfb626a4e20e1fddb36028d018634
SHA16e536a55d87814bad019e52b20d8303e91124778
SHA25641d3ecbf5cba680bdf23a9d40ec2ab6c561dea6e68820a09117c62483a48da84
SHA512074941cc4e68a1c053dfdb664e3afbfbe5b3d731e5d547035620ce552c866b8042473224313649231a294cdfc96b7560893a26c540cb4fe74d75b4e99c484869
-
Filesize
677KB
MD535e82027ddab7996192175d175ba488c
SHA1be9fa31102efffbb44d7a20dd1a8e7a4b185a2ad
SHA256edc5038411ed851fe488e54e869df9dc5a0121270b779d33e89effbcc88a0f91
SHA512de8fdf7044f6aa5fe95f67a58c9c99b988c4f12c6acfb952bccea3fbfba7f4beee858ee9705d6e8e9e5b020258760f4b5ad177c695df7eadcde71001ad2daadc
-
Filesize
3KB
MD575d1ccab8520bfabd34d4444274ea03e
SHA1f08adeb49c1d9718d3137efc845b2d1163d9298c
SHA25609703d7d10745add74575a38296ca703f71d1b3a29c3df733b6ea9ff290da23b
SHA51291faa42be41fdd59309a6b5caed6f6dcfc895e6b12bd14b3027fc4815c05f4f7e8f4b0e2563cf6e212f6dcbaf0893055d366be21be7b663a07db40bf5eac7a8f
-
Filesize
3KB
MD52fbc4b051768196ebd081846bac0be8e
SHA147ac2f9e7996127f07e3188928428f6fa00eef58
SHA25688c7e5c8b69e1151e2b3f2283ba3d574064522972659b08bff9563da7f0cfc52
SHA512e7a00aa134949f489e4f5e2def9cf47ee62a0af7949e96b89ecd60b391f0168747e171c35c150aad7c62d815956f91c7330a8d3d13a69666c5e4eb40db0ded71
-
Filesize
4KB
MD53c1247dd247a5c7e7d426e3e1f78ec17
SHA12931c8a190ddda1aced4d66e47dfb1cd1b4fe2ca
SHA2569bcc30ac5a67b06305013e234ee77652eadb18968ce783a2f3bc79ebd4216c86
SHA512883b802bd3ae9833c75009533e126b1cd2dde2b7ab2876e55355ea9bffaad167a06e2cd25cba60fce9904e7764c4a959eb26c5f059ae9c8c26261b83b4586b1f
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5193420c65e5a90976ff0e0413848de59
SHA1ebe0f7430b9dc770e1ca2c78e08cd783371ab5c5
SHA2566501408cb4216221af18abaeec77ac0262bc97e69d22c31b0067ddc96ba4bf09
SHA51294511d6ccb0d6c967afb3f3a6c5e26674341b6131020fc389e8cae2c2040b67f6293ca3e57a08cf3f0007d64d6950e9be58f2575b190c6834010df985c80e8c7
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD58000bc3c04b4283609170daa94d8fb6b
SHA17b346cb637a6d54f87297b30535c40ade6b53146
SHA2566138eed610e227f5e2b744ec3f7c8fa472aaa4dcdac2c465079752ff8d6635b8
SHA512dfc8392c942ead228273c607c422db27cc068c50610660daf9bb84d5486ac041cb2971e046c0b4a1151db91a784151d5aa63e0c823d43342b964ea99a430ef8c
-
Filesize
173KB
MD5f9846ab7ed8016429b6b76cbf86c6fca
SHA1e0c61c3573467959a2deaef66742938a211d36f3
SHA2560427124dd7a2f88e0fc22706750d3212bfd0d9c4f3225aefbbd0d41feb15ed9a
SHA512c0807d2c75e450bc1c88e5285cd9254ed5aed2c51649b49d57a1653241404d68e3ecbbdaedfbcb660d95341c820a27e791b963aa64a6aae1414481ba4d9200f3
-
Filesize
16KB
MD5fffbb209ec8c6a0f4c44d9e83dc999c5
SHA14d300a94d19947061d97cb67d7dee9147b6f30b1
SHA256accec939f7b7f376a51f22915ceb03716616aa2af755d55bf7a5916b9abde63b
SHA512c05dad50cd1c676584061e4e5dc2bfcaad1cc9c69026e874cb3ab8f99bd95662b3e2afdf69864c744d7e39421638d5b80867039e14fb72134947011e2e1e475d
-
Filesize
1.5MB
MD54fdb4489998b24cd1c9c6625769ec3ec
SHA1e515c55c75be675060e143fa525f770f1534ad50
SHA2563f1ff2d8838ded4ab4cbfdb11576185e51c8504d61bfffad0a981c050b5d9c85
SHA5125375341dd4f4cb146d31ddfc38dddc47e682f68267d27f2d50913cd5478778f17601327f1cb06156567f8d98a2ff37c05729f435888e6bf348db4efe437a9471