ermac | 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59

General

Target
560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.bin
Size 3.8MB
Sample240225-1xjeksde86
SHA256 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59
MD5 508280b8a33592fe3e3ec3bab918998b
SHA1 72956fc4394e95b0eef71dd330ef27d453cd2c36
SHA512 f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311
SSDEEP 98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

hook

C2

http://91.92.250.168:3434

AES_key

Targets

- Target
  560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59.bin
- Size 3.8MB
- SHA256 560bada1b98136b64cb55b33eb6193351d7429d7fbe5a116d2d5f1e20acb0e59
- MD5 508280b8a33592fe3e3ec3bab918998b
- SHA1 72956fc4394e95b0eef71dd330ef27d453cd2c36
- SHA512 f2eaaeb36ce04115ce8fb9b45ffb8bef7d4aaf46ae7b6b01065c053c31556f5271d789e8557a3af8c83962e005da4abfd63067fd480fc5acf3cb52bb6a4ce311
- SSDEEP 98304:R+hJ+I8GYJHVY+JTkijX+v037UcLUuQwy:ghkIEE8TkijX+8pUuS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hook collection discovery evasion infostealer rat trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3