ermac | 75c4c98cd2c85c5801f33a910287cd0508dd0cf2c2281d13f46b67a1e2a9304a

General

Target

aaec5d207147fb4b4700c2e0b82b7272.bin
Size

901KB
Sample

240503-bzerqsdh44
MD5

63da362a6416992cdda6c7b9f70e1ca6
SHA1

7005edf824f3ac9878585b7a6d05dcfce24f39a4
SHA256

75c4c98cd2c85c5801f33a910287cd0508dd0cf2c2281d13f46b67a1e2a9304a
SHA512

fc06f76ffeb351de73e00b378019483c253c76c01af63d5894443a93fb0253dfcf3aecd48d6b0088132d534e51f542ed11da6993243f0a260aee40bb27eb1a7f
SSDEEP

24576:Kep/Adtnt4gz8aId5S48QUC3BkI/kqK4Cw:BRmD448au5aQkEkqjb

Score

10^/10

Malware Config

Extracted

Family

hook

C2

http://103.67.163.33:3434

AES_key

Targets

- Target
  
  0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3.zip
- Size
  
  1.1MB
- MD5
  
  aaec5d207147fb4b4700c2e0b82b7272
- SHA1
  
  3b01954ea4e1a6488ce0f9a044b89fa513d2d3dd
- SHA256
  
  0968f706d92da8fa371cf88aeb4ba60e44733035e3311c60f9d36addb1c9d5b3
- SHA512
  
  9a622b83b03d8a723ff96fe7840899251767e22d2190ff043bbe57514afd72ca561c33e65b6f5924942b6ec67647f9d22ee66b726b8a1fd3543cb7ea9b5b445c
- SSDEEP
  
  24576:56KtLf51JR8li6FE+KTj8uKsZjheVlEz0P/mjyW3g/x/A1:NrezFEtTj8uKsAVA2/5W3g/y1
Score

10^/10

hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Prevents application removal

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3