ermac | 0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f

General

Target
0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f
Size 3.3MB
Sample240307-l9vwtaaa2y
SHA256 0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f
MD5 8d958576257733bd78fe81f84e768ed1
SHA1 cd19e464b30b42d80a532cd994828696dc5f7b9b
SHA512 9352203c5c06e69a2521041f3eb4751af80295ac50828b3e6a7d653198e6fb4db671b2fa214e3e3c166cf2a4c22ef54a5e87e40d6ce145a32a5c23b71a487683
SSDEEP 98304:TAxM4GZm5vjgae1B4IIDjl5OMxeAPuYXv+r5Pd:xZwMaQ4ImlAYeQuYXv+r5F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

hook

C2

http://77.246.108.116:3434

AES_key

Targets

- Target
  0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f
- Size 3.3MB
- SHA256 0121588ca4de977d77b3492af120588890cf758924fdb3412b780879d8d2192f
- MD5 8d958576257733bd78fe81f84e768ed1
- SHA1 cd19e464b30b42d80a532cd994828696dc5f7b9b
- SHA512 9352203c5c06e69a2521041f3eb4751af80295ac50828b3e6a7d653198e6fb4db671b2fa214e3e3c166cf2a4c22ef54a5e87e40d6ce145a32a5c23b71a487683
- SSDEEP 98304:TAxM4GZm5vjgae1B4IIDjl5OMxeAPuYXv+r5Pd:xZwMaQ4ImlAYeQuYXv+r5F
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hook collection discovery evasion infostealer rat trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3