ermac | 87d425f966f518fcda3ea563c7709a7fb9fd5a9b16be5e18830d8a5f875aa585

General

Target

ea763f5f92a66c49bf09e411ed56aa91.bin
Size

1.2MB
Sample

240503-ccrnfscc2x
MD5

d4a0f5c3dbc0738ab9ab418b7661f59b
SHA1

ec2d4ee5609ddd9baddae07f651b4a29af821988
SHA256

87d425f966f518fcda3ea563c7709a7fb9fd5a9b16be5e18830d8a5f875aa585
SHA512

7283002e3a1e1296388c7ac334c34166340396140c16fc7a2112541417a528bbdb8faba3a56fae02a5a7bff67c30e4f955cd457721c220429f8735411ea73832
SSDEEP

24576:AMmpEAY4nbvGBBLtIKhX8zBV8z2sC+M4jcREWVVij7M4kI:Vm3Y2eBLte0CzrTg7M4kI

Score

10^/10

Malware Config

Targets

- Target
  
  fe1be052250f53b52017499744451c614e4771a392efa37afeb1b4774d861df0.zip
- Size
  
  1.4MB
- MD5
  
  ea763f5f92a66c49bf09e411ed56aa91
- SHA1
  
  542e42f9c5bb76a52201f8201c9cb74ef42f6ca9
- SHA256
  
  fe1be052250f53b52017499744451c614e4771a392efa37afeb1b4774d861df0
- SHA512
  
  fdc5aa4c570b0e4af513f7f62d64a420ed42d378a1edc4ddb93aeacdb2216be4ed6e0f907170fb22cab2aced2d065792623f34ee0a38a52ccd7e298fd3a7060c
- SSDEEP
  
  24576:6uEHnPqQ7129BgZCl0e0llmRBfaLuUQFsudmNdhJSOfo5BcCdIuKZgpDAg/4zgdY:buPqxAZCOe0llgwBVSO07XKZgpDFzdgv
Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Makes use of the framework's Accessibility service

Prevents application removal

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's foreground persistence service

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3