Analysis Overview
SHA256
ae502f67782e9cc2a6e33b868f14467f3dabf126e868a8e10a68aa2ddd4092e1
Threat Level: Known bad
The file ae502f67782e9cc2a6e33b868f14467f3dabf126e868a8e10a68aa2ddd4092e1.bin was found to be: Known bad.
Malicious Activity Summary
Ermac family
Ermac2 payload
Removes its main activity from the application launcher
Queries the mobile country code (MCC)
Registers a broadcast receiver at runtime (usually for listening for system events)
Loads dropped Dex/Jar
Declares broadcast receivers with permission to handle system events
Declares services with permission to bind to the system
Requests dangerous framework permissions
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-05-01 22:00
Signatures
Ermac family
Ermac2 payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Declares broadcast receivers with permission to handle system events
| Description | Indicator | Process | Target |
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN | N/A | N/A |
Declares services with permission to bind to the system
| Description | Indicator | Process | Target |
| Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. | android.permission.BIND_NOTIFICATION_LISTENER_SERVICE | N/A | N/A |
| Required by accessibility services to bind with the system. Allows apps to access accessibility features. | android.permission.BIND_ACCESSIBILITY_SERVICE | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows read access to the device's phone number(s). | android.permission.READ_PHONE_NUMBERS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-01 22:00
Reported
2024-05-01 22:11
Platform
android-x86-arm-20240221-en
Max time kernel
3s
Max time network
82s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Processes
com.rekezapayojekubu.kebi
Network
| Country | Destination | Domain | Proto |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| GB | 142.250.200.42:443 | semanticlocation-pa.googleapis.com | tcp |
| GB | 142.250.179.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.204.78:443 | android.apis.google.com | tcp |
| GB | 142.250.200.42:443 | semanticlocation-pa.googleapis.com | tcp |
Files
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-journal
| MD5 | 5b9d778395f69592902a2f6628942c9e |
| SHA1 | 1e74e2bc8fa5d44429a728cf1bc874b2cb5767dc |
| SHA256 | 548a8f149e86c1718951ff60c897735b9d4a32729cdec6ffdca71390124798be |
| SHA512 | 4c09eb2d25bf8cf35881032fa6babd3c5ed2905f6c68078b61dd34e67300b83c413a4a2839170de7f51fbd2e46c82383e902240554722b3466f2d3bed127ea59 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-shm
| MD5 | cf845a781c107ec1346e849c9dd1b7e8 |
| SHA1 | b44ccc7f7d519352422e59ee8b0bdbac881768a7 |
| SHA256 | 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7 |
| SHA512 | 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-wal
| MD5 | 4e57f4a6837381919ba542ff30bcdc83 |
| SHA1 | 27c69d1159be93af3c83ade1506062aebff03c92 |
| SHA256 | a1842197228ab5a68a0ab5c33c07815d78e5a8d4a13729d4d6d1319139f72109 |
| SHA512 | 69006bd26d6560578cd8d12c715e2833afa406d2508b1cd796c04813bc807d10277b8d2562ed0eb29c1e189d2f24132dfedbe3eaf1570acf527a456be8a499e3 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-01 22:00
Reported
2024-05-01 22:09
Platform
android-x64-20240221-en
Max time kernel
5s
Max time network
142s
Command Line
Signatures
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Processes
com.rekezapayojekubu.kebi
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 216.58.204.72:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.178.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| GB | 216.58.213.4:443 | tcp | |
| GB | 216.58.213.4:443 | tcp |
Files
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-journal
| MD5 | 76842da7af250e9ab2910ecdf25d74d5 |
| SHA1 | d0b86c5294cf14253ddd1057b158242b329e2f84 |
| SHA256 | e116c020b5f994fbc3fa935c768476445bb7c130ae9b17d338f0ed1884441896 |
| SHA512 | 351ea200ef628c99f2ab4d43ec46430fbd8a29ae4508db5be8b64b51285e77e599081fe36fe465bce25d2a01afa29e198ad51696e92716a3e04b71d047581fc3 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-wal
| MD5 | d1b50dae8fa554129ec50f6088b5fc6c |
| SHA1 | b119c82b100a7daffdf8fa03f2f67d7f0c25c1ea |
| SHA256 | 1e0f815845525d582e96d4584a79561c72e3e997db5a6fb7be34ec6e6d80a95b |
| SHA512 | 20e1050364b8f846687cb9e06ea41dc52ef4e624a692e5869d0f920e09bebbfc0d1bb90222ac1e1ae693b3c196f2af530909d29a3fce550ee07210592205b289 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-wal
| MD5 | 5714c5acf90e90546822964a50fe4898 |
| SHA1 | 5fb75fdf8b6a33cb740cd2d5417ff5f43b2eeb3d |
| SHA256 | 2315435aaf99ea12e05b0a8026b1ec793bc201119ceaab735cf8dbb2009497dd |
| SHA512 | 11987f0d8bf32c5450d983921878e35efa4eb14770fa24a8fb20359d429cbf237b795cbf2603d9a903d55ff719a98aead26733d7225675d8d8b4b8546ca0cd31 |
/data/data/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-wal
| MD5 | 1429df389a7d2409240f4aee30a26a6f |
| SHA1 | 45f2963905769b94a28d4d74fcd26d95b022ea33 |
| SHA256 | 342b708622e9350f2c0f01a3149049c9136fc6548a04cb150302eadc4dbf3708 |
| SHA512 | 7528196e46615943d76af3c5e441e276a50f220bcd78217f6becebe937f8643ebce4743af35d1423952a8c744b181204c25514d11bd4ab28bd6d482eed29080f |
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-01 22:00
Reported
2024-05-01 22:10
Platform
android-x64-arm64-20240221-en
Max time kernel
5s
Max time network
130s
Command Line
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /system_ext/framework/androidx.window.sidecar.jar | N/A | N/A |
| N/A | /system_ext/framework/androidx.window.sidecar.jar | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Processes
com.rekezapayojekubu.kebi
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.200.14:443 | tcp | |
| GB | 142.250.200.14:443 | tcp | |
| GB | 142.250.200.14:443 | tcp | |
| GB | 142.250.180.10:443 | udp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.213.14:443 | udp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.169.14:443 | android.apis.google.com | tcp |
| GB | 172.217.169.42:443 | tcp | |
| GB | 172.217.169.42:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.200:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.200.36:443 | tcp | |
| GB | 142.250.200.36:443 | tcp |
Files
/system_ext/framework/androidx.window.sidecar.jar
| MD5 | bdf3529e80318eb14e53a5bf3720c10d |
| SHA1 | 25c9ace4b1af6e80ebb2572345972c56505969ba |
| SHA256 | bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b |
| SHA512 | 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b |
/data/user/0/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-journal
| MD5 | 4273f48c5bbe3e80e3367ff8cc56bfad |
| SHA1 | 391a074d787fc4a35dc0910d494d9f762d3ba93e |
| SHA256 | 1a18594e217ed6c3a938d518c6ee444d8bc0f13c7b43e08083678f61aa0c0147 |
| SHA512 | bde16d6c4d58ff5d5854447891704d3e2acf51c693a4b70805c298c258c8f6ca2ec741b4a77e261b3c68f255a77f967178491c3150dd7c5c7319026e48b3c485 |
/data/user/0/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb
| MD5 | 7e858c4054eb00fcddc653a04e5cd1c6 |
| SHA1 | 2e056bf31a8d78df136f02a62afeeca77f4faccf |
| SHA256 | 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad |
| SHA512 | d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb |
/data/user/0/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/user/0/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-wal
| MD5 | e8a191f025f044e7b1396a3ebc6f097e |
| SHA1 | 5bf5a74a57dd88e340b67297988133eacab9f993 |
| SHA256 | 971ea0cd8f4c33a952eb7cf653a3013521f343fe2867087684d58ca3c2115927 |
| SHA512 | 8ba9e6a70a04ce79f3df9bed67fa80aa6ce02e5777ae64f806a6442e1e6943e17dce1c5fe16628322bc87cdec3e0df8065c0f871cdf7bdf114d1691a1d32ece3 |
/data/user/0/com.rekezapayojekubu.kebi/no_backup/androidx.work.workdb-wal
| MD5 | 0a5eeea04736807742ea739b7ec93ea6 |
| SHA1 | 68217de5fe984eb5de2165de2039bece346a311c |
| SHA256 | 33d78fde26683611ded5772ecea6908fd150c9476c3e30e8aab17f9d484da81e |
| SHA512 | 070f0688e5d422c135812d01ff8d0262671dc1bfe4eba680568a249c81eeafac595e4ddef2000616e15cee92581df4f8820544c91193726f8b2362d41e321f81 |