Malware Analysis Report

2024-09-09 14:27

Sample ID 240519-cd8ncscg79
Target c97552c072fe2a59affc6df0974b8bbecd77f64b8924c1d5cc707bb2dc7f4543.zip
SHA256 c97552c072fe2a59affc6df0974b8bbecd77f64b8924c1d5cc707bb2dc7f4543
Tags
ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan banker stealth
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c97552c072fe2a59affc6df0974b8bbecd77f64b8924c1d5cc707bb2dc7f4543

Threat Level: Known bad

The file c97552c072fe2a59affc6df0974b8bbecd77f64b8924c1d5cc707bb2dc7f4543.zip was found to be: Known bad.

Malicious Activity Summary

ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan banker stealth

Ermac2 payload

Hook

Ermac family

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Prevents application removal

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries information about the current Wi-Fi connection

Requests enabling of the accessibility settings.

Makes use of the framework's foreground persistence service

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Acquires the wake lock

Declares services with permission to bind to the system

Requests dangerous framework permissions

Schedules tasks to execute at a specified time

Reads information about phone network operator.

Declares broadcast receivers with permission to handle system events

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-19 01:58

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 01:58

Reported

2024-05-19 02:02

Platform

android-x86-arm-20240514-en

Max time kernel

179s

Max time network

138s

Command Line

com.kalazanabarebi.nodimoha

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Prevents application removal

evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.kalazanabarebi.nodimoha

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.169.14:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.178.3:443 tcp
US 1.1.1.1:53 null udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.178.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-journal

MD5 77be7488e62b9b15fd2450c0090a4b49
SHA1 924a54e79c6bf7c958b78052ea95ffee7065a553
SHA256 b45905a628b9d5b2aafc192c01ce9513352e96b4e5ea2510b7ef148b83cd3b69
SHA512 b6686b81115398177723b64061361d8d110eb48f348a50f47ed0b43083f2c42f315420848681f95bcf0bf8ba5aefb55e7de501023492ce774557a61ac6f0b58a

/data/data/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-wal

MD5 00a812221058022e42d9a6fb298580cd
SHA1 000c8ca96f2c0b7d983f21ae4773eef835defa9a
SHA256 41472e1805f7213881c20d5cf3ecc4d9e21c998c8ce09e8bb8b559b3d20a7715
SHA512 0a1bc481e2b7b1882498c13816c0da63518d320a27f90448ca9dfae336c3443fbde3593540b9d2983abf233dacdb6f8f6f13e2cdd8d89dae60294540eac146b1

/data/data/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-wal

MD5 ff75bd4e79d6f82602f2ac2a63f8cecc
SHA1 41d1e1f479fbfed1172daeaa0f5cd0bbe84855bd
SHA256 009a7a46aa5e3a5c280ccfa5dd0931c067ddcde9c7fcf4d32fe39c8a2c38109f
SHA512 89e2397f328f6665cc1df08c10736a031f9b83c64beecd01f9e1d1da65b47aafd384f57558f4095a3a00a0823942f8a5c443e7dcdb4d7e2f61955663d1dda230

/data/data/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-wal

MD5 3330c7f9d17ba8154adf52080614eec8
SHA1 f284426e8015da59a72371e3fb5b55a5d29a2cbe
SHA256 d00c987ffc0a784c5a033e63ea8bee79fa97e958e22ed971f42a8a3d0a73aaea
SHA512 cf39b68b77bf52a63ce4a9e61a6f24163d18fe9b8db786a0512abe56857745bcd648cff55ea99538ff7c6dceadbb1a480d7b1f4b98819d46bafb35b7527783ef

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 01:58

Reported

2024-05-19 02:02

Platform

android-x64-20240514-en

Max time network

171s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 172.217.169.14:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
BE 74.125.206.188:5228 tcp
GB 172.217.16.228:443 tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.169.36:443 www.google.com tcp
US 1.1.1.1:53 g.tenor.com udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.16.234:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 www.youtube.com udp
GB 142.250.200.14:443 www.youtube.com udp
GB 142.250.200.14:443 www.youtube.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
GB 142.250.179.228:443 www.google.com tcp
US 1.1.1.1:53 mdh-pa.googleapis.com udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-19 01:58

Reported

2024-05-19 02:02

Platform

android-x64-arm64-20240514-en

Max time kernel

179s

Max time network

188s

Command Line

com.kalazanabarebi.nodimoha

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Prevents application removal

evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.kalazanabarebi.nodimoha

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.201.106:443 tcp
GB 216.58.201.106:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.40:443 ssl.google-analytics.com tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
TR 91.151.89.38:3434 91.151.89.38 tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp

Files

/data/user/0/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-journal

MD5 71f7712216ee2b4e8421a3b6d8c3c23f
SHA1 835479bb59a6604e2285443858bbb78b3397c786
SHA256 d36877e8a101d8d5d60df8dde60d42ca03a23ce546fd98e7d0d6bab642f9672d
SHA512 30157167396662c6df49cabfcd14e5dde7807b17b1093ee286f6ed90bd4d5b4cfd3a26f0ff8d6cc62971089c871633bf5e73d272adcc778870ee223bb9cf59b0

/data/user/0/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-wal

MD5 1218c6a44a4342b15b490d77666d19ca
SHA1 ed7430a5beb766d9e8361ce89ef318b8353a56e6
SHA256 702d96fd744fd5a73d021838c0fc69334e2874940c0262497a2d93278b02dd41
SHA512 f57702d6455135c6c78524ecec765649f9bd9abf85a795b5a8a6ea6e061e30665f1f237510972f9c99738bf15bf1c9ed9738983f5edb453f44ef65f42d6a5c72

/data/user/0/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-wal

MD5 0e3644b474327c640a5ca4343b5be135
SHA1 76718bb833e225633e5b5367ab894333cf0f1373
SHA256 c82935536d8408c6d22b364eb60eda64de97c14f178aabbd9198eb3341f2e8a3
SHA512 e8ec54253a52913c648bb07365ae294ad47a8cccf24f085c747dcb4bb5f5cce978a3107ca39bd3e1f8669c3d2dd0ef76e7c8b279ea460f7b319e58e80a827b19

/data/user/0/com.kalazanabarebi.nodimoha/no_backup/androidx.work.workdb-wal

MD5 082353041e2f5bfc55596366815070bd
SHA1 40376081657a069edd0cc4917766d56252abb5d6
SHA256 3b2e7493fd805c177683029833cbf1e7245afa6201fae931fc815575e9fa4f9f
SHA512 29b9a7bfb4f03f66877a8237e76722f5b2703212dfd91945b29875077b711ed0067b674c218050ebca039a1df94ad681144d11ea4f5a3c07a8735e02dd944744