Analysis
-
max time kernel
148s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
21-02-2024 22:04
General
-
Target
a43946e9c775ee011f2096fc3c6b214c9ff67120e7cc1fc65a871314c77667ea.apk
-
Size
4.5MB
-
MD5
b7b97cf97ff8613287235aa92073a011
-
SHA1
cb865d41b36de015d18592ffc58e21fc678a9951
-
SHA256
a43946e9c775ee011f2096fc3c6b214c9ff67120e7cc1fc65a871314c77667ea
-
SHA512
cd194740bcaad2913d9e5b34e5066782cb239b60738f40cf437b6793404be09ab6c58dfce0927181a8d9dedd5528f545176d21a39c666656cf2b4e670c9fec6e
-
SSDEEP
98304:2zb0xgao/PDnNCZVmorrJnGNBZqiOuKsVFh9B/9Q0/UN0rU/rWcFqDt:o02ao/LNCZVpXJ8bVXdvx1/UN0rUj1FO
Malware Config
Extracted
ermac
http://93.123.39.152:80
Extracted
hook
http://93.123.39.152:80
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.yFWrHZpr.fjyaObQj1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD523e7d3eabfa943b967908956a41ad81a
SHA1fbcddc18efb5657ac233f8b9be4d792831c2d84d
SHA2560c680cb30aef5934d78f0bb006fde3a35a87187e0b5a3616a14cd4da6efe0517
SHA5122cedb09f8e870d6f47f76d44875161ed8ea96f1555b1d7ae2b069694864b84d4f680690c8bbb11de9d046a5882335448f696ff31c42e2aa317c4da28d4d809e9
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD56cafb8092bb0006604a2067921021a22
SHA1c1b643cacd7d9515576109f900813defe2f56a84
SHA256a9f7eb9bedca2b78b13b4a5033c25c5c2141b4160e12a0cb48b31197680c6b03
SHA512d13fb2799be59547354215b5ea8ad5270f0bb07c4ab0faabe5620a0b25649f64a3f3a2837a94c34d3f823e27628ed84e43d7a7b2b15d5de463c9596f98433106
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD50a075d564b9916ba178bbf722bffe359
SHA1a9bc374e18582857b3b029f00223a398edc87624
SHA256622b8b28f7f9b44aa4cf7c890a80ce29948b44445534b47220e2978c8c82b086
SHA5124ad13b1edbb2cb863cbbf57945bedc97225b69774c9cab8cc6efd13800ae72cb8770aa31e78e56c7b2f8d1092ad83795412506db67458f6ffdc1d1351c96b506
-
Filesize
108KB
MD566436c1d284471be4473e354dbcfb2c1
SHA1805e472c15ad02420778d93037f761615280e1f8
SHA256ab5d7f11cd069ad769509f5976bb9c86b9e2ede89532782ffaa10e68bd6aaec6
SHA5121c4076327b21e9ed9947475c38f408161ff6acb3c869f167c67c5fbe65a7bb3f753dfd0e2e08727e4c54f368c9ddcb433da7f329b0f9745312c5fbb4779840aa
-
Filesize
173KB
MD5ebecd6263117cfef78d91e0b168390da
SHA1f609bc22b5fa6c96e0dcb17d1f7c4859293a8642
SHA256d9ed8c1fcebb7dbf9828d3b1e58aa91ac5981a5785a7e017e11a535bef56f58e
SHA512b604c298a043ddbbd97c366cb90df1c1f9f030089c08d168a6fec3119dade9005a465fe1ab4f2113af2a7eb7992c8f4677500260da655753bc11b5ed95b3753e