Malware Analysis Report

2024-07-28 11:43

Sample ID 240618-xjmcjavbjb
Target 0d0c23a96dc90d431a8ce01f0cee1575.zip
SHA256 aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531
Tags
ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531

Threat Level: Known bad

The file 0d0c23a96dc90d431a8ce01f0cee1575.zip was found to be: Known bad.

Malicious Activity Summary

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Ermac2 payload

Ermac family

Hook

Hook family

Obtains sensitive information copied to the device clipboard

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Makes use of the framework's Accessibility service

Declares broadcast receivers with permission to handle system events

Acquires the wake lock

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Makes use of the framework's foreground persistence service

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Schedules tasks to execute at a specified time

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-18 18:53

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 18:53

Reported

2024-06-18 18:56

Platform

android-x86-arm-20240611.1-en

Max time kernel

42s

Max time network

186s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.202:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 172.217.169.10:443 semanticlocation-pa.googleapis.com tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp

Files

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 78be8a9d049d499342279db9fe5d0879
SHA1 648f988e22896903485a933ad125a8c1120e346b
SHA256 3cfc047b99e1814e51e873b2f50db2f9b1061387758b209cbb93ec9ee6213783
SHA512 3cb5425aa9416977bf54d1b6e34906c271cdb213d56281bd0e2592cd31ac9aa649dfb8c19037b285e27f4545c009ab5696b434535b863462f9746e36bc50c004

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 8a1614d218a6a153576efcd64b720132
SHA1 f555916b585d09ed6239019225d158ecd626f3a1
SHA256 0b750899f27f8ecbdb384fa279d5f282332dd17a67f8477fa67f21279f7c8d6a
SHA512 886e140dff000edc72294febe63e612b92400076de09fc2132c73bbeef1bc32cbcf824c5026d12e23924c94a9f3e0a3e4e900d0ef51de3bb3c6308d142dbb8e4

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 f18b0006ffb27873eef22db8c7fc6e7f
SHA1 fb175637bf0487fa56ecee05ff57334db4a7b68b
SHA256 5f90026c80268350263e0f7bbae33bcfbf92f8ca7642cb021fe28188e534fc88
SHA512 6457d0276d2eabc5d6d2ae6eea5d8e059f29c409765ebd532ba0faba3cd2e48cb4e4f061e9c23eef870fd0db562bad7cce003aec6772fb6ebd99a2b7caf9d921

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 8d419d13646d8c7684f801d1ebe66bc1
SHA1 d61aabd879916760546f55e96c0d0c3c0ffa138b
SHA256 5b9470f23e3c0e4beab64c087056959f46f1306673319c3e53a689de11fbb716
SHA512 cf5193c06b550ce345d09cffd05daebba12aedceef8c56152057bac0c05fc54bc49e2e0314fb6e196bfc7735312e1a3f57c7667e9d09bab83fbc55f243ec064f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 18:53

Reported

2024-06-18 18:56

Platform

android-x64-20240611.1-en

Max time kernel

178s

Max time network

187s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 172.217.169.78:443 tcp
GB 142.250.179.226:443 tcp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
GB 172.217.169.14:443 tcp

Files

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 efdd45a593569c4b0ebde441b4f1336c
SHA1 049eb70992278ab63de7dc33debc47074972c3b6
SHA256 4711f02033cd4b5f7a50a36f08a6af8880822009f5771abfad4953180516c7db
SHA512 d8992b59d19bbf1efd96f17379ad4815ce8766f51b641be6e5037b62f3fdbedc593c37418175c3993b4398a9afdd7d328e7ea39dc4f214d2d4f9f128da3e9850

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 693716a27a042c7a0a186bc8236e1026
SHA1 35a71972badedb6369fc95fc6af5e8fb970cb000
SHA256 ee0c5d02a08b04474856d2f3673edeef1ccd7787831086a229443e2bdd9b7cc4
SHA512 c7f798e89182854af471f9766b42830af05a445a3312d626c6de768e6d38f67b589113f049e53fceab1f8f5eda66775ea928c7925ad4ffb44896abad81f57611

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 82a885ebc6e7d33acbd07b52838e2011
SHA1 03456d144f845a220de9ba60b104f260ae359a47
SHA256 2eee59d5d60ae886e28a1c9386a42db6062476b3e56aa7b636bf0ed6b95e3ac0
SHA512 cf9a50cf781bde922f3ffe43658262ec2687984d83c2d7eb98fe213a83f3cf1e55b160c61f628f707c8f2f1cd220ac4418da728e77af928b4181f3522955dbd9

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 25a679b9aaab218ca6eb427037346929
SHA1 64b6964ff69cae07c4e13471c2bfbbb861812058
SHA256 c4ecfd7447ca3d46d31721b8abf1686da3abe6099e6b231bf662715ebe6524d3
SHA512 5b87120629ff1d088e9db3fb879b8025fa049da35409cae2a56bda77fd1b1762167e456dfb6487fd4c419355b25750196e1b94a923cb56c308664feb0a21b224

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 18:53

Reported

2024-06-18 18:56

Platform

android-x64-arm64-20240611.1-en

Max time kernel

177s

Max time network

185s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.212.234:443 tcp
GB 216.58.212.234:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.8:443 ssl.google-analytics.com tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
NL 91.92.254.104:3434 91.92.254.104 tcp
GB 216.58.212.196:443 tcp
GB 216.58.212.196:443 tcp

Files

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 be9ac4750c0a4d524b152af068c28608
SHA1 d88a306daafa18740a0a8fe31e8ee1d47fa7b158
SHA256 d08383164c2e23174bbb6adff9bf27a222709a1cea1a20ca8898b15a9281e794
SHA512 ac7185acd9fcc8855f30815be30e103341f45004f19a938fff588dcd3773b02cdcb268ce6f771949a3c769b79970a1a7aca2c883474ab17c5a8b07250ad6b7bd

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 dcd2449b9b727eabee78a939549572e7
SHA1 aa0666e6374218c21a8ed61faf6d42ea26688c8d
SHA256 2ce2ba68af69e8de7303d747f665b78a583709e6dc2d68916b9601545d40004a
SHA512 040e1a77f3a629fabb823c115ac2049db8d6d9f8801b9d3e7d6018045ca370feec0ea22844b9ad18fe66b4e13ddee981e39bf45867b71aa007d7e88a2da00672

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 5916dac44284cfff267e765b60cd08fd
SHA1 7c37b4725fb8b113279d4fa1bd8f25cc29b97d9e
SHA256 bf1fb07059e1d6453b2f734de09315467de06eb1a976292fa28cffa0874d093e
SHA512 b235c9e2c8d3510a603c177ec5bbb5a8b301421b150f94a60e9c1e26c31ae9322903b300f7f56a5f11e84694af34f6bc29203b83b141dc83237eb581bb8e9b4a

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 7354644fc8211f9a141231ebce6e622b
SHA1 25b21bcd478b2c6daf9291507547978f5cf2235e
SHA256 7a35bb0d281694a04834fb082ed367835868997811e2153fbc8a495258e30f96
SHA512 5226351ad0fd62d45e36843249dcb1577361bf3c8869f3b104ad78a3132d0935b25aab9ec950973a8d86a65c160f19ad6551ac953ab842eba4a22ae2091b1115