Malware Analysis Report

2024-07-28 11:42

Sample ID 240625-1x73yaydkq
Target c2281b06c7ccdb65b1d0617254959a29905c582bed7537904eed800cd8004751.bin
SHA256 c2281b06c7ccdb65b1d0617254959a29905c582bed7537904eed800cd8004751
Tags
ermac hook discovery evasion execution impact persistence collection credential_access infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c2281b06c7ccdb65b1d0617254959a29905c582bed7537904eed800cd8004751

Threat Level: Known bad

The file c2281b06c7ccdb65b1d0617254959a29905c582bed7537904eed800cd8004751.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook discovery evasion execution impact persistence collection credential_access infostealer rat trojan

Ermac family

Hook

Ermac2 payload

Hook family

Queries the phone number (MSISDN for GSM devices)

Queries information about running processes on the device

Makes use of the framework's Accessibility service

Queries the mobile country code (MCC)

Queries information about the current Wi-Fi connection

Declares broadcast receivers with permission to handle system events

Requests enabling of the accessibility settings.

Performs UI accessibility actions on behalf of the user

Makes use of the framework's foreground persistence service

Acquires the wake lock

Reads information about phone network operator.

Requests dangerous framework permissions

Declares services with permission to bind to the system

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-25 22:02

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 22:02

Reported

2024-06-25 22:11

Platform

android-x86-arm-20240624-en

Max time kernel

25s

Max time network

185s

Command Line

com.tencent.mm

Signatures

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 null udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp

Files

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 9e38e63790830b3caf117ce35533aa86
SHA1 743f6ca5d02a21e4fdf69219f2d70ab668277100
SHA256 c1bfca9ad5513738e36a093936417b7e97577fd024e78b914d6072ec3a48990b
SHA512 6b9529878e0e775105dca1905745942b97926a6d8dec95924d881bdc97ad1f908b7aa8fc0c9fddad7d409ee95bb758fea142cc34bce6de0735e7283913e27068

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 4752044cd2dbc1cb317e43d3fca681ec
SHA1 14044adb1acd21d1957ad68f7e544efac8503c2a
SHA256 b4bd803593cc5c22d35ede3dd468c63b632d69fe7d7bd36954885472e8d236d7
SHA512 5eda7b58582086911cdac6ce54078692a03d1d859ffb61843a75ccbf0932745f7bb48e62e60b0770c07d6b74d118758592ef7994fcc2f217df12ab79fc5e5f46

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 f23ed82d1c185eddac84eec5c3b7b416
SHA1 7512095ce098410be45567f8c9bbff154bdac182
SHA256 7f9969d50f15bfecb160cc14432eaedb9f2c2d4e15640aacc33982a79c1434e4
SHA512 66d265c74ac4b08f4c71056f22a226d8c8fa1a669c1d5514d71c5aabaf290883add72355ea4b419a8d6dc6ba0a6a50abc49fb9756dee726a99c1baa2bd25b5dd

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 1cbeef47c0c49da6017d2f258a12a0bd
SHA1 6f2b44ae46a1c16142e9843e1e4f4d1e9b23db1d
SHA256 65a5b4d56d370450be08038449f445a0fbf30aa41d159fcaec3ad5f54a3abe14
SHA512 547fd83bf8e99fa0907fad2daa357601df448c4d856f5c5d062a9f6384709c4fe9080bb07886fd5e83188dc15a1beb4f36b9923404b2a1dbc8e4ed5f27c09c5b

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 22:02

Reported

2024-06-25 22:11

Platform

android-x64-20240624-en

Max time kernel

53s

Max time network

186s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 172.217.169.74:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.204.74:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.204.74:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp

Files

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 7359a4ed0022c987b55e055ee0b5641e
SHA1 b7e00aab5becc4e516105010a0528be3af6b0208
SHA256 6af5444dfc45831fbc356feab1982aa6f39500dea6075235938404bafec82a94
SHA512 3c811e2c294a56de701cf21d862d609d1638abc68defcb9fb9585aad5cd7ac78a0b2899289abd89e0b7325675540909d6bbaeb840fcf4ab50d8077e3823daeff

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 1c210da4ad9fd22189755268771ab14e
SHA1 0092a33135c4d474eb2617f79b64198de04bb945
SHA256 4e8273167b451af4a9fcfb0b961c9459fdc283328dd3b258522243d44b121d91
SHA512 c0742ee5a2c5bf5397f0db682a4d8b41c823f02d588f029cbfc54f8bbbec177df5c41000d7046c808a49c8eff1f79e3609a9a7117d4eae2fe689e16996e8995f

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 300e4a44023b6d0b1f25a16248aea49d
SHA1 3b7600571144f4313dbc138d3fb2cc577d737cb4
SHA256 579e292b228378a1175f3b20fd076959128141fb60c7b301ca0f6fd36ba95af1
SHA512 61114dd88085dd8d999533dd7aacf2160244af78420eb2ad12b64407c54297c3296d7743d56ec8817dcf15dbc6292d2b27eeb6bf265bb63d0cc8f8b42ae4eb40

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 11358be7ec69750eed8fe397d9f3648f
SHA1 9c910a641f10b4edd03cb39dd736bdc1812da5a3
SHA256 994004d5557be284fee584658ec23787ead05966bfba13b1ac86054560ee2283
SHA512 326cee672f34b16cb77e20f18ab844a863d4f09b8f580db4c623aa819e046146bb62e43c1fa370be6e2040ef4f69a85d24ad416c83201ef6ff78a4e7d38e36da

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-25 22:02

Reported

2024-06-25 22:11

Platform

android-x64-arm64-20240624-en

Max time kernel

78s

Max time network

189s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 216.58.213.10:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp
DE 138.201.113.11:3434 tcp

Files

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 5578b5e66d9fab7ac8ccd355f44130f4
SHA1 41d0de76309a6c68c4a8e1d26b4804ddf64daa0c
SHA256 ffe495902032696c8fca5e931e2f4b44549e2593ac64c5ae6bfaff0410fbbb6f
SHA512 0aeb7a2509559c9fae4f13c601cf3f56fbb2a4cf385ec05f07994a84e3df94682063ba27b4fd86ffec4e448495911316db12d855d196b0da4941e182164350d9

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 d8449ea9fc7d0ea548eb31f99da06aa2
SHA1 05aab55ea8d96edcd4f4e4178dfaba15e0ff1943
SHA256 e1a6786ebc2aa54fad3d525898bd5195f9ff69853d6af58e907600b2f30b1b04
SHA512 b81d239cbcdb4a123e58b04b5966c3fed57c636bca19f4bd8bb262223e28b94e2e2c93199b3739dc6b4d589240894a6d13369e1c6af313943b93bd83fe9b3e11

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 cd49b79da5ff7eac587623f0f92fd025
SHA1 bc16087c7cf6471f26d42a2acea6dd09ad948fbe
SHA256 0bfca21c74a6c3695190c8fe7deed2f3d9e836017597fdeeb87e61350fd52792
SHA512 05cbcc8808f9233624292e663ee1c2024ec386ca27e9fa6fde46419ef7d6699cced6e77c89a8f683c2dc93cca25b73208ec064eb23867d4fac70c39e4c014373

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 922779cb0cb91d039c351f59be3e57f6
SHA1 9632ced17204417da6485415e3db2a98f34cdcd1
SHA256 afb9ff0a97d3d0f2335bbda9f64bc4a4c8cbdbc141e7c96cea0374ebc4945bbb
SHA512 fdafad6b677dd83e2e8cd9fc652b4c671e20a6822c6e985a2b2363d0740192ff88025f5391119c04f08993d5cacc02087a96be13e472699cb59a187f7a6b23db