Malware Analysis Report

2024-09-09 14:00

Sample ID 240501-yd923sha98
Target d59a4848b584fdd93eb3d0b554a8df58
SHA256 32e4dee58ea17addc5df4ffb862ab3a8df1697598cb6437f92de4075665812c2
Tags
discovery evasion ermac collection credential_access impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

32e4dee58ea17addc5df4ffb862ab3a8df1697598cb6437f92de4075665812c2

Threat Level: Known bad

The file d59a4848b584fdd93eb3d0b554a8df58 was found to be: Known bad.

Malicious Activity Summary

discovery evasion ermac collection credential_access impact persistence

Ermac2 payload

Ermac family

Makes use of the framework's Accessibility service

Queries information about the current Wi-Fi connection

Makes use of the framework's foreground persistence service

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Loads dropped Dex/Jar

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Declares services with permission to bind to the system

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-01 19:41

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-01 19:41

Reported

2024-05-01 19:44

Platform

android-x64-arm64-20240221-en

Max time kernel

4s

Max time network

132s

Command Line

com.gejalevubakupa.sugi

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Processes

com.gejalevubakupa.sugi

Network

Country Destination Domain Proto
GB 142.250.200.14:443 tcp
GB 142.250.200.14:443 tcp
GB 142.250.200.14:443 tcp
N/A 224.0.0.251:5353 udp
GB 142.250.180.10:443 udp
GB 216.58.213.14:443 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
GB 172.217.169.42:443 tcp
GB 172.217.169.42:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

/system_ext/framework/androidx.window.sidecar.jar

MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

/data/user/0/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-journal

MD5 511fe51bca761f575bda9da9064f3379
SHA1 4442717eb89575cef7ca99f9b2ab4dd8f61172b9
SHA256 88c970eda605fb3aaa50b86ccf3af41f93617fd62007552e35741a8a26bdd6f9
SHA512 bd9c87a8d7a21039224e9e6c01d2bf482e20d1825b2e6059bce42a0a68ff88f9f1145c6a7e3cbfe0fb2904e4dd6f6bdb75e303acb01f9c9f4a67a2a806cfc033

/data/user/0/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 010824f656f287698a61c87c31dea9d2
SHA1 80764aba63669432be86828601a6726470503880
SHA256 807c4e35c2fa36fcac69883e949b1526c380f00d4491e8deb2ad08a33e2e4877
SHA512 aaf87706a0ee216c2e5b436c7931a18986718858bdc3997ba14a46124ea8ed869cfa9745cf78fce35834554e4e41c9e45657b54f29671049a4869456b781f339

/data/user/0/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 a2a404ff4834a6dd928e4fc904bb6c34
SHA1 f794fa049d0242c6e476fdeffd02aa5a3520a0c8
SHA256 3a3bd337431c9605e300a6aa276dcab9ed26b0b183c234a8054c993ae2085965
SHA512 8ea945dc6f1a43e219985857376115d787be8395bc375ea3756e72903ab673753fd626010fbfd6a99d353ea79a5ff0e04bdfbd772954a5476bd98713c0976f7d

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-01 19:41

Reported

2024-05-01 19:44

Platform

android-x86-arm-20240221-en

Max time kernel

52s

Max time network

141s

Command Line

com.gejalevubakupa.sugi

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.gejalevubakupa.sugi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.169.74:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 null udp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
GB 142.250.178.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-journal

MD5 24e3b07736146f62e0d98be31662c43e
SHA1 56775adf925d5cfae3c8025cdd43a3d445c37861
SHA256 63fb70602cc96e02ace911f35be032c8ec6cff323a73be608fa4f0f0dea0666d
SHA512 015e1a65bc4a90a97a4bedf2ca933e6d405bdb0794fd3a74320d3f04de259f913f1e1e63b61af53870cfd08a6df98a891e826af243bc8543e73185088bfaaafc

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 64471bfbc9eda12e79080b4eaf2ca535
SHA1 fd541b260afbd888b8b7ec521fdaf3f0c096dcd5
SHA256 10179788f2af3a41ed5c510a6f4cac2adb0398d777a7992b52a3e11ff52b6f43
SHA512 a0383f5c48ec75a80b21cf5ff5902f775877bc6740f100c87315ff7bfd895abdd66ad12e289cd0dedb6be8e9558430a97bcc3c91c1a1718f4542bf0f53a6fb4b

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 813ae19c36363ee4a09e1be47d3ae1ca
SHA1 e555410ae28e890a301193e0b6f40e687f158cd8
SHA256 84195000daf300c1474c2d4c16721f5960df577af9504f48d55608cc830cc160
SHA512 45917c827c27f3475e9e7e0c82cd014af8f0e72ffeb64644ab441b1b5a2a051511abecc6e8d733e0b6a7ff0fe7b3d8604a970cce97ad962fca75c8d03884f395

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 e06b781bfd9fa845b1f6ed44ecfbee6e
SHA1 d95c7677f48543b5276a0b6fc6879cf5a295b306
SHA256 faab687f8c910d7550ed3ce31bd1865c451213fc630aff69a30f9cdf6890b77b
SHA512 70bb3b34b218ae406a7cd56aab23c19c9d0a0b6b672a211208bbe4981450156ee437dce62fa61d40c8fd22635bdf3441cd420e7923dd475e4c1df2a6e0e30227

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-01 19:41

Reported

2024-05-01 19:44

Platform

android-x64-20240221-en

Max time kernel

52s

Max time network

155s

Command Line

com.gejalevubakupa.sugi

Signatures

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.gejalevubakupa.sugi

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.178.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.179.238:443 android.apis.google.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.2:443 tcp
GB 142.250.179.238:443 android.apis.google.com tcp

Files

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-journal

MD5 8caa1162aa62bdf95c1f242c07f14f65
SHA1 1ae240644c6b5161737a7d14774c30ce322fb221
SHA256 4e084659fcdadca25ca531847f97222c034c9477dd27bfea41cfcd49a865031e
SHA512 d61cd15adf7a60def9371882b17aca8ec28f9a9d069fa5e324be226c86f4ebfe98127a79ac7758eca702f06c1c09221d5d5da6564e34d3de14be36cdc35eccc9

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 ccff3300d65d912f34cbb18bb8b130f1
SHA1 2b1b9d58d965de516206afa86af30bfc3496893a
SHA256 498bd1bffe34fa07d4ee90bd58735fce52561a24e7c6d2b4c6c784f491fe07c6
SHA512 3b19197da5d39fe3d0443dc6a0a3e9f300ab289d6d587057ca17c1111ed84c4e29bbf41fe6cadc3bb3cd6311afc95100910512df80fe689e289816c55fb54b13

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 0b3af07d1cc68a98018e90d7a6f48c35
SHA1 63479a43bbdd39f860048c0f28e70cc24a51b12c
SHA256 5885fabf125281640dc76ff0ac531de9040628c4ace17e9bf49719ef45733597
SHA512 64af6854e8f0974ccec946ea577b9c153a6b1e2bdad661dff59629cb84556f172407ca3f6349d654bf0aeb72616c968043a5b465ed0d992ba6a07f9a0e601868

/data/data/com.gejalevubakupa.sugi/no_backup/androidx.work.workdb-wal

MD5 25bafaaba599dfb4eeb5cef1a2faf98a
SHA1 4aa66d6b5c37b1cef6c836b939a737a69c447dfc
SHA256 8067c3f74a67b5bf34c06ac8a20fa959736dd4c9e614871225c197b72974184a
SHA512 9cafa708f02fa69b17137af05c24f3538cbc85cf242535e838b4d59726567352da1e20d02d6f963d77b2ed903a5ff85e53ba0bbd2a11ec4101dd8f06edeaf8f4