ermac | 7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129

General

Target

7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129.bin
Size

3.3MB
Sample

240322-1zmvsacb6t
MD5

6655869d1d383f4dcfa50d1ce79400f1
SHA1

5ca1d9317b46881d6d96e263c84be001be628b4e
SHA256

7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129
SHA512

915fc72f92bdb1bef9b2103b65f553d4dc4099dc09c354f40dc2aef851bcaab9abab82c85e0ee3c3bce370c44b7abef2caeb85c3abda19c5c52bc357ccbdc355
SSDEEP

49152:44dtlY6Fn6KZ/Pi3WD/CjnTxxooLvXZ+pYXs6lPhARlrkeHWD0uwAQb6qQdTh0gw:449YO6SgWD/CjnTzooDp+pYXLeGNaw1G

Score

10^/10

Malware Config

Extracted

Family

hook

C2

http://94.156.10.254:3434

AES_key

Targets

- Target
  
  7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129.bin
- Size
  
  3.3MB
- MD5
  
  6655869d1d383f4dcfa50d1ce79400f1
- SHA1
  
  5ca1d9317b46881d6d96e263c84be001be628b4e
- SHA256
  
  7b2125a569736ad0f21671abc0532eb75825c62d1f66c02daeba9f7d6df14129
- SHA512
  
  915fc72f92bdb1bef9b2103b65f553d4dc4099dc09c354f40dc2aef851bcaab9abab82c85e0ee3c3bce370c44b7abef2caeb85c3abda19c5c52bc357ccbdc355
- SSDEEP
  
  49152:44dtlY6Fn6KZ/Pi3WD/CjnTxxooLvXZ+pYXs6lPhARlrkeHWD0uwAQb6qQdTh0gw:449YO6SgWD/CjnTzooDp+pYXLeGNaw1G
Score

10^/10

hook banker collection discovery evasion infostealer persistence rat stealth trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3