ermac | f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a

Analysis

max time kernel
141s
max time network
156s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
29-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a.apk
Size

2.8MB
MD5

0d938686bf6169169e6aa678f9f95154
SHA1

fb690af0a6bd7ce46e08096bcafe366123cf0a3a
SHA256

f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a
SHA512

d25b4a40be79bd86eb5547e8170efb041eac0e7aa92185ebefccfead83e193e5c8073b2a2ccb4fcf43ad0b3894369a3fd1e380428204440f2b8e321ae3ce8278
SSDEEP

49152:g86XQt6FU+E2O3B1My9jLwGMog8rRgaTTyXqyCFHnrN/lGojtDmIAOzt4:g7k6FhE2OTxCgRLTy6FnrJlxZmpOZ4

Score

10^/10

ermac hook banker collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5089-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hanafehozevu.rigilacu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hanafehozevu.rigilacu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hanafehozevu.rigilacu

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json	5089	com.hanafehozevu.rigilacu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hanafehozevu.rigilacu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hanafehozevu.rigilacu

com.hanafehozevu.rigilacu
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5089

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
674KB

MD5
2766071bd26a34a56af8bfbfd823809d

SHA1
60f8683dc0a9fc77007edc863960104ace3e8462

SHA256
c431ade2814e21ed95d7d6047bdd241ff96e7780a2c50547c8e2870cce9bfc5a

SHA512
457ed1972dd5325efb306b433408478c04cc6fe30c65b01c970750bc57e59f50ac9760eb06c55ee7391cd701019dc232d7f100a9dacfcb88445f86c8c9a732bc

Download Submit
/data/data/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
674KB

MD5
cc07c2243fa78f1555f531c29094a17c

SHA1
e3dc6283baccc7b511117cb56893019b91fb4c22

SHA256
23e661a06d4c5bd456e4710519662d32d80e4ab6d8046a9787b1efac539cea85

SHA512
f451f9d5cf3ef64a05286aa6da04431e30ef37d2cc0e0544f1f5c7c3c50e4727c8c06c92a72e607c6b521c3f3a100d946b7c192721ddd87c4d8c46a139d5a492

Download Submit
/data/data/com.hanafehozevu.rigilacu/app_DynamicOptDex/oat/XdaeO.json.cur.prof

Filesize
3KB

MD5
18db331d60f5242759e4bed7e8b7d668

SHA1
af2e6940035dc191256840cf0e7508b7599f4a9f

SHA256
dfe46d4657ed0bac2e3fd18f161eae60f34dfdaa619b72d94122927bb2348583

SHA512
c4070ed49a5f047f56d7450268b4f038ff5bf3c212c983720129b26e689c9f05ea9d3def3b961b693f736d5a545300dfc74b37f1307d431a052a7ced561df1e1

Download Submit
/data/data/com.hanafehozevu.rigilacu/app_DynamicOptDex/oat/XdaeO.json.cur.prof

Filesize
3KB

MD5
d8207aa943613c334ee8a12d11e7f299

SHA1
046b98abdee0f390a7721a0640f1ffe5abb75f72

SHA256
152bbad610ad5d329ce128e2f3f60d62641346f5a5612182c8dd43209a9520b7

SHA512
ee39c51e42146fb5ade06b3da55b7b22558afca13dec43a29f4d232ecbf651490036fc6a53b7c7c1923da3cfdf524a234663f4ecdc53560faf9c49831921ed1a

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
1.5MB

MD5
97c94f30ef4fd62b945b883ff3457fc7

SHA1
7d8ef97ba034ac7caa899bac1c5d84afb89ce605

SHA256
cb023cad19cd1e2d48eb13afbdd31b4fee2bd5514305b32f8e753333dc9d28d2

SHA512
63db09bbd1b60066a07e625dc67872d5241c8c24baa989f731dca13c1f8187ca34cf6a698a83a5618e47a8a15c5a14d48c986ca33b9ab69223947105e46fb684

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads