Analysis
-
max time kernel
376906s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20230831-en -
resource tags
-
submitted
09-10-2023 22:00
General
-
Target
60a84a9c1f41257573d5c2ee96926ae56c2e7255b62526b432bff3818a95d438.apk
-
Size
2.8MB
-
MD5
7c71a0dfa8b60f6ef52f3d6c0c1d8f3a
-
SHA1
7eeeb0cd33994adb728fcbc8376666a9bcb63b74
-
SHA256
60a84a9c1f41257573d5c2ee96926ae56c2e7255b62526b432bff3818a95d438
-
SHA512
eacf91ce4fa315213b3936f95accc7cc7339e1cc1623cb67c9e8c52a696de9250ed2596c782ce55c8fb28ef8a1f7aa8c219ef5c371d4e18b5610b0edf8594f6a
-
SSDEEP
49152:jhl6sJ8552sjbU7g8d8qbdm0rwa5ztam7D328ugZ4e85W3/Az:jhlCdjgwqbdmIrXrr85R
Malware Config
Extracted
ermac
http://91.215.85.37:3434
Extracted
hook
http://91.215.85.37:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.zeriyatetahelo.hodi1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
677KB
MD5853bfb626a4e20e1fddb36028d018634
SHA16e536a55d87814bad019e52b20d8303e91124778
SHA25641d3ecbf5cba680bdf23a9d40ec2ab6c561dea6e68820a09117c62483a48da84
SHA512074941cc4e68a1c053dfdb664e3afbfbe5b3d731e5d547035620ce552c866b8042473224313649231a294cdfc96b7560893a26c540cb4fe74d75b4e99c484869
-
Filesize
677KB
MD535e82027ddab7996192175d175ba488c
SHA1be9fa31102efffbb44d7a20dd1a8e7a4b185a2ad
SHA256edc5038411ed851fe488e54e869df9dc5a0121270b779d33e89effbcc88a0f91
SHA512de8fdf7044f6aa5fe95f67a58c9c99b988c4f12c6acfb952bccea3fbfba7f4beee858ee9705d6e8e9e5b020258760f4b5ad177c695df7eadcde71001ad2daadc
-
Filesize
3KB
MD59678d0725ede8cabff3aa6acfa68e7d7
SHA13f1d7c3d151a1c0cc43aa7051c2a8a9076b7b848
SHA256f38b2b1432eb76ad9d803a3a564a14904a88391adfd9fee0fc55c0bcddf1060e
SHA512d51022e47736cdcc87dc57581e2acad8a48fedcd447962f1861f0b62e161ef47da874bb69beeb62c1ca3f3a79d4d409fd15077e450067a9e10fb01499e0f01eb
-
Filesize
3KB
MD5e59ce670b2ec4c32acbac372b2dfafb4
SHA192e557be050b3a979dd9f7fa41bb9aeafed9dad7
SHA2565290aae937ea61243af752eb6d2418d5896d95d675053121abc718d0c1c4c5d7
SHA512fc4c9a647fe6fab1f56f58d0172ab51e02074588041a79e99e66cd98ae1f4ec48a669f2e3d3368a834a591ea02a2bc8ecdef0c749204a681ac8720ffe23f9570
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56cc91848513937a6435071c5a520b620
SHA13afadc63bb534dc911679724721bf0b057ab0794
SHA256b764702d8a7109367e6898e63dbf7fe9e08c6a04556f294a10b780d27c958524
SHA512feb78ce8e9e2d175f164a16bd861e1f69083fc3e866cb738ad45b0ed320d3c2d899222d6ab40f3b0f28bf3f840f843f616bde1cf7321272c107cc3341c2daec1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54ead9b58cdeda19b6dc093efb9d216da
SHA11de1fc7956bb0bb1c5d06bae151a1e46f7a69356
SHA256b8288570f8d0b3f540f8983ecd417dd3d2e16ca7f9d50c329f230222e696f62e
SHA5124e95f3fadc806d5fb9d3492c407407063786463b6cfd394de7aa7f9626740f5a2123672d6e179d28538a9e17fa099b3534347f1ee09f252f02ffa7db4d83612c
-
Filesize
108KB
MD525a6227318bdddfdaf22f7a77d040707
SHA10ddd2d4e7b09094f797a5796990f908b576038bd
SHA256b2adcaa5a7d1bab35a42a160d4fbb83d00d6296a343e9f7360644aa94ee2de66
SHA512beb7bfc071921016c25d87472d457c9f5c317869a20d01b58f529bbb4bb2a3a846a755cefff13cf7f895bf8fefbf7f4219980e012076d66eff9c7ac7b3ef276e
-
Filesize
173KB
MD5a9f88ff9c6fbc72e011ad4c9bdbf5bd1
SHA15ffbb47cdd4f4da6e126858f5c5679a739482759
SHA2563611c1a4b2f8a7436d28c5902e232bf848e2a7d7ebdc846806c2c50b82589731
SHA512ea776f885bef09e4925ef2b2be8940733d08320b749ea225a956734178d22653762563118ebc0ebfe45e75b9a473c40ead062688a1e72ba8a3e936c73a5e5a77
-
Filesize
1.5MB
MD54fdb4489998b24cd1c9c6625769ec3ec
SHA1e515c55c75be675060e143fa525f770f1534ad50
SHA2563f1ff2d8838ded4ab4cbfdb11576185e51c8504d61bfffad0a981c050b5d9c85
SHA5125375341dd4f4cb146d31ddfc38dddc47e682f68267d27f2d50913cd5478778f17601327f1cb06156567f8d98a2ff37c05729f435888e6bf348db4efe437a9471