ermac | f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a

Analysis

max time kernel
38s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
29-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a.apk
Size

2.8MB
MD5

0d938686bf6169169e6aa678f9f95154
SHA1

fb690af0a6bd7ce46e08096bcafe366123cf0a3a
SHA256

f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a
SHA512

d25b4a40be79bd86eb5547e8170efb041eac0e7aa92185ebefccfead83e193e5c8073b2a2ccb4fcf43ad0b3894369a3fd1e380428204440f2b8e321ae3ce8278
SSDEEP

49152:g86XQt6FU+E2O3B1My9jLwGMog8rRgaTTyXqyCFHnrN/lGojtDmIAOzt4:g7k6FhE2OTxCgRLTy6FnrJlxZmpOZ4

Score

10^/10

ermac hook banker collection evasion infostealer rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4297-0.dex	family_ermac2
behavioral1/memory/4271-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hanafehozevu.rigilacu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hanafehozevu.rigilacu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hanafehozevu.rigilacu

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.hanafehozevu.rigilacu

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json	4297	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/oat/x86/XdaeO.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json	4271	com.hanafehozevu.rigilacu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hanafehozevu.rigilacu

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hanafehozevu.rigilacu

com.hanafehozevu.rigilacu
1⤵
- Makes use of the framework's Accessibility service
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4271
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/oat/x86/XdaeO.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4297

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
674KB

MD5
2766071bd26a34a56af8bfbfd823809d

SHA1
60f8683dc0a9fc77007edc863960104ace3e8462

SHA256
c431ade2814e21ed95d7d6047bdd241ff96e7780a2c50547c8e2870cce9bfc5a

SHA512
457ed1972dd5325efb306b433408478c04cc6fe30c65b01c970750bc57e59f50ac9760eb06c55ee7391cd701019dc232d7f100a9dacfcb88445f86c8c9a732bc

Download Submit
/data/data/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
674KB

MD5
cc07c2243fa78f1555f531c29094a17c

SHA1
e3dc6283baccc7b511117cb56893019b91fb4c22

SHA256
23e661a06d4c5bd456e4710519662d32d80e4ab6d8046a9787b1efac539cea85

SHA512
f451f9d5cf3ef64a05286aa6da04431e30ef37d2cc0e0544f1f5c7c3c50e4727c8c06c92a72e607c6b521c3f3a100d946b7c192721ddd87c4d8c46a139d5a492

Download Submit
/data/data/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
1f70705143b9bb36a43d084c66e2e329

SHA1
450789fff308cbe8a490dac3b95e6b3713b256af

SHA256
646f48f595f5eeaa71f5f0842613b0c2a8d772926d1e7727522ad96c8b87e698

SHA512
74b3abb23d221a1696b4cddd0d737eb5e55c559d3e5c871d2d2a55ee0c0d1e072da6e5d32fe138997603c64adbf2cfb6a53e5fea73e8170ea0db590654903126

Download Submit
/data/data/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
cb52c9ff415885b6510e61ec589c25e8

SHA1
f7e2fdf46b9d376c30e0174bf3757baeb1b28f95

SHA256
eba0279a8e42d99915feb2df8ed1b961a94cd4faf63e21176ebe6100af7f382e

SHA512
523b4fd1be77a0434cb18e63c912a627dd059cb03aa64f14a1af48c542fb2642ef1156809a17b86f428bd62ac12d25599281645ebdc0de2b962935030c8f7651

Download Submit
/data/data/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
127dc0a81ddb2d30c0b39b9937aea8ca

SHA1
383525032108e227bb405a2de77b3cc26ce46bff

SHA256
839043d5422c57288e81bf7b2c5c579c8136019933b0238d141ef1e9fa4fd09f

SHA512
c50be70c4deef00dd62ed37cd7c1494b35db82b1be9c5aa7aa91b35ec1766170821e99c08da8d6a34e8712140aa34f1e74d0971436a53dcce5825992a5e58442

Download Submit
/data/data/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f76849c10971a6851c2a9d1f1ca5a5fc

SHA1
b5c08493c0b5b750398eeb8c595e63ff8b49e2d1

SHA256
c8f9d1e6dde110336fa3a587f010ace7001b0a5adc29999ae5711aadfbfad568

SHA512
d6788e0a39ed6da775ff2430b0e86a294db63583cbe2f57bf9efe1c2c7d20efa3b51e212c72ea93ec01f715c54468b6b15b8abb55ddbf013fdd5591768524d93

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
1.5MB

MD5
b0c01023c94507bc9c4b23adc2a53697

SHA1
14bae163d6c27a1f35f36aab681269644d84eb98

SHA256
1f2520a9b65ea20a3fdda49c565d9c4f13534fb5bfb27664aa0e9f7d80f481c5

SHA512
495d84ce961b0fbc3c0e4dc7784f4dbd745a5e322fc88fdd12298ec318f31e44e1572ab4e2e0da873bb914ec5d2547a6d29a23df77f0fc28d2f708c0d1621002

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
1.5MB

MD5
97c94f30ef4fd62b945b883ff3457fc7

SHA1
7d8ef97ba034ac7caa899bac1c5d84afb89ce605

SHA256
cb023cad19cd1e2d48eb13afbdd31b4fee2bd5514305b32f8e753333dc9d28d2

SHA512
63db09bbd1b60066a07e625dc67872d5241c8c24baa989f731dca13c1f8187ca34cf6a698a83a5618e47a8a15c5a14d48c986ca33b9ab69223947105e46fb684

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads