ermac | 0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3

General

Target

aaec5d207147fb4b4700c2e0b82b7272.apk
Size

1.1MB
Sample

240502-a8my2aec46
MD5

aaec5d207147fb4b4700c2e0b82b7272
SHA1

3b01954ea4e1a6488ce0f9a044b89fa513d2d3dd
SHA256

0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3
SHA512

9a622b83b03d8a723ff96fe7840899251767e22d2190ff043bbe57514afd72ca561c33e65b6f5924942b6ec67647f9d22ee66b726b8a1fd3543cb7ea9b5b445c
SSDEEP

24576:56KtLf51JR8li6FE+KTj8uKsZjheVlEz0P/mjyW3g/x/A1:NrezFEtTj8uKsAVA2/5W3g/y1

Score

10^/10

Malware Config

Extracted

Family

hook

AES_key

Targets

- Target
  
  aaec5d207147fb4b4700c2e0b82b7272.apk
- Size
  
  1.1MB
- MD5
  
  aaec5d207147fb4b4700c2e0b82b7272
- SHA1
  
  3b01954ea4e1a6488ce0f9a044b89fa513d2d3dd
- SHA256
  
  0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3
- SHA512
  
  9a622b83b03d8a723ff96fe7840899251767e22d2190ff043bbe57514afd72ca561c33e65b6f5924942b6ec67647f9d22ee66b726b8a1fd3543cb7ea9b5b445c
- SSDEEP
  
  24576:56KtLf51JR8li6FE+KTj8uKsZjheVlEz0P/mjyW3g/x/A1:NrezFEtTj8uKsAVA2/5W3g/y1
Score

10^/10

hook collection credential_access discovery evasion impact infostealer persistence rat trojan stealth
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3