29a12ccff165ea81bcce05a3338c54533785867b9fde7b8ecfa457020cea4ef8

Analysis

max time kernel
1087s
max time network
1045s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
04/06/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ermeo_1.135.0_apkcombo.com.apk
Size 49.0MB
Sample240604-mfr4hadg32
SHA256 29a12ccff165ea81bcce05a3338c54533785867b9fde7b8ecfa457020cea4ef8
MD5 15309d091f36dfd173b081da173977dc
SHA1 b664059c9dc0398a74d4d727f752e39085787ccc
SHA512 9ecd52293c9c0ac8907df8484751fb68a95a33577d75cd19f1119cc2bf0bcbe6e95f0826910a548f548526fb95a430443c84430e5c56ffca34105c745abf6ed3
SSDEEP 1572864:1Gyebkh5RJsW0O0Ou9Tg6KmSCooAJR+1DikBMqzCNMXdlWLLg+t281eUO/dvwvGu:Pehh6P
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.ermeo.ermeoapp
/system/xbin/su	com.ermeo.ermeoapp

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ermeo.ermeoapp

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ermeo.ermeoapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ermeo.ermeoapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ermeo.ermeoapp

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ermeo.ermeoapp

Checks the presence of a debugger
evasion

com.ermeo.ermeoapp
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Checks if the internet connection is available
PID:4523

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.ermeo.ermeoapp/databases/com.google.android.datatransport.events
Size 56KB
SHA256 8bb4864a5347d0e3709788949eba8f4f1d33c1a7896bd6202e86e3a79b551c4b
MD5 5f23854b695c41bddea1593004e1de65
SHA1 a3862b983d49cd1794801eadfcd31bcb0d80b88c
SHA512 d6d564bee45b8d36395cb7087ac23904b561ac4b9433093044854e3ad00a7f7321ba363460ccbd3d10e334063778aea20031c5a85d29b286602f14a535f1a074
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSY:rAMEX0wIyNjaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ermeo.ermeoapp/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 d3110d7cd643953da4da616b5cbfb7251c449f9ba23b9644868152857b166ad0
MD5 0ace7e2d006cae6cc14ee3f8887f1d9b
SHA1 84a92d4aa5acc365be5ecc4e3b266b44d4265175
SHA512 5ad5c9a83e2e40da57d2e8f28d2d8577bf65ff561e9fd6c0cfbc7fc0e3c7d68798d0668f54eb83d74ea028863b0292730eecd966ce9c0abc323df70c32b26f96
SSDEEP 6:7+/l9tFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKEt/k:7+tPBqLJdeWRmBEyPb/k
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ermeo.ermeoapp/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ab971f320707a8d8d26a06161da35675bf2312f38966c07595d894747ba5fd25
MD5 2a165f32e0b448c1c9b2be6b40ad7a26
SHA1 1c0bfddc17827c9e671f89268a10e4c0c321ddce
SHA512 192d37cf8e04f91b1581f42395c4b0e3ba8f0fad4b93ff0b4188880ac2ca5ed1d52c6d2586e40dd0934e2173c3ae6402df48136993e5b0cf9ccce7147b3cb619
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.ermeo.ermeoapp/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 441e3459f0549a24b34ef38d06732922c11137cf760cd5b4ef1e2ef8a0b5a7f2
MD5 e2c82efd07ccaeedbca8575e27f6dde5
SHA1 e84580ca642d7d82708ae3a8c328f75178d4788b
SHA512 503a33b4cb6adc92c73051dc0bbe8c2522b10b31f1eae3c443882d79f1629fc6fe8626d3861aff2d5c3fc006a45427d2a736844d0f953257f1b79c1f5e61d450
SSDEEP 6:7+/l9Zgn1J//vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKh4:7+tfk/nqLiuWdYRmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.ermeo.ermeoapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.ermeo.ermeoapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 13d4551a2ecf175572c55947bfb20bdf5700b1c336ac0bab395c619277f4208b
MD5 9c2a62c315168d5e538b5f89b0bb58d1
SHA1 15ff48bca58699f654dca0fafad5f452f3f6441d
SHA512 3a004eda49c98231e5ce1e05f25138a6d8def585b29aec82c3626a5107f28ce4b3518ddd55106c0cfa1d667b87ac74648b4b79c1547a87e1aa70b4770c750ed8
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl66:TLiEq9zmzrfRmBEyPbP/P+/0Fl6U0Ry7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.ermeo.ermeoapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 916598737163db1cd6c3d7fb0158736ccaa4f472b2bf0bb0e0c199dd4a39978d
MD5 b7ede21bcd2c0c783c7f268440c185b0
SHA1 894fd1ff4b9a48c5d444d36130a4a5fa4680d528
SHA512 e3d2f16ee3b076f362b0985ff02eb8469e41d4973a71a3b7f2580e87d231dd10067190157b1e95b0a9abfc81f36f61b2859b3b883f66849442f35c8736a51d49
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFljYhJhV+/0Fl6U0Ry7:TLopmzr0GSP/h1499FU9lFT0o
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.ermeo.ermeoapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 6002bacb4fd9b5db5d4c96b837a4819461e4699848fda287cded3eae2472f3ee
MD5 fad3c547a0298218b2696b3ddd652297
SHA1 5c9636d7f328ec6a7b71609a8a162565698a56d0
SHA512 b1ec12fc5b69f492209a7ee3b77fda0c41e70cbecf537b818ec4334a3dfc61728e31b6ac641d1736257cd9b42fbb600f905a08864d1592350beb9aaf313dfc7e
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWlzfR49blqYFljYhJhV+/0Fl6U0Ra:TLYpmzr0GSP/JKabCCbtR499FU9lFT0o
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.ermeo.ermeoapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 47c55c64c49146d4dd41f587d9e97be9ba9fcadeb763863760c4ea459f1125cb
MD5 e747a508bf6e026a8b53b3eb27605f1f
SHA1 14025e357587c93e747e09e083b50af1e2fc1ca6
SHA512 203c755220299a43059c708eb56453d13cc55ff0d50f3f5ec333e6aa91d6e379bcd93a4b637c6b4733ffeb2946485f9d1ad4a65d5bae75f9d9a06a02e86a9664
SSDEEP 24:TL6vpmzr0GSP/uKabCCbtR499FU9lFT0Y:T2vArSP/7abCCbte5ET7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.ermeo.ermeoapp/databases/google_app_measurement_local.db
Size 16KB
SHA256 b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d
MD5 818548be1885386cc995f564f36a8e8e
SHA1 008b0c602ed55b1122dadfb3a20db517d55c10b3
SHA512 47840561a1eded73600b656576a7a9195bd1beddb79b08090b9e6bd9ab610de6cfb0a334310bfefe0b33ef157d420aaa17c6315fa2e689398da3328c4460a02f
SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEe9zmzrfRmBEyPbP/WK
MD5 SHA1 SHA512 SSDEEP

Submit Download