Malware Analysis Report

2024-07-28 11:41

Sample ID 240625-1yg8xawdqb
Target 21d7ddfb5df55459b6fd4da0977a52987f5ba0bef8474b9fc72e584048515bf3.bin
SHA256 21d7ddfb5df55459b6fd4da0977a52987f5ba0bef8474b9fc72e584048515bf3
Tags
ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

21d7ddfb5df55459b6fd4da0977a52987f5ba0bef8474b9fc72e584048515bf3

Threat Level: Known bad

The file 21d7ddfb5df55459b6fd4da0977a52987f5ba0bef8474b9fc72e584048515bf3.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Ermac family

Hook family

Hook

Ermac2 payload

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Queries information about running processes on the device

Acquires the wake lock

Reads information about phone network operator.

Declares services with permission to bind to the system

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Requests enabling of the accessibility settings.

Declares broadcast receivers with permission to handle system events

Queries information about the current Wi-Fi connection

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Schedules tasks to execute at a specified time

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-25 22:03

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 22:03

Reported

2024-06-25 22:12

Platform

android-x86-arm-20240624-en

Max time kernel

61s

Max time network

132s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 null udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp

Files

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 26276073736662b2e46e77f64f2635c6
SHA1 108dc6bff46e7b822feee4ee3c6d61671e5cadf2
SHA256 2f5c643db03fcac40661c69b0051b8b4bec2860f4fa4b95308bc6d15023dc901
SHA512 103d67f8719681e81187dc582fb55abef1c31187b1bcb039e953219de3e0e34c6984f110c5f378a39158d0e2a4fcc162b8e1e519986924e460e7df2b48271afe

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 317ad513cc330d6e9874546e01c2c54a
SHA1 2248f44e372048fb67fc2535ae8c5218e2526a8b
SHA256 e5042ab311aa2046301117ce1c54f139051f66794b4de9cf805b57600e0ff64a
SHA512 a4001d66ad0cfc0e3c5b9cd14806a47162190b93665cd4571faec21fac155bcdb6e831d4e512cb901e1f1af48bf3e705104089b106ad0c4a301b7205f4c6f268

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 ae5c6201906ead33a40c99d3133ed534
SHA1 fc92ad1ed2776d5898216f0133a1261e2bbcbe5c
SHA256 0f80f4b6b367b851de523322f5d1b0b9060cfd247209741c71af2a031dc91b77
SHA512 7f3c7e50b856b3b72e8639b581e17a1680233ac09664f8ad37180bbf68504e67d567f532fae2cdd300e9ad3b456e811b78726e5e4533fb8e42b35a20883c6d8d

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 41ca781cf49130a5420753604ff01142
SHA1 db471a0584d036a28d645bed170669cd5a607c06
SHA256 37837b686aefa554126a3aa71a2aedfd2b99598ab97b3bdc261c4899ab7e8696
SHA512 78d035bdff500a66828415e33b16c7d4c9daa1c98e57d6c07d6d2a0ddf659d75b8248b9816f74408b672de85aa0ddadf980dc9572eb23b249b864f4f13a90c1c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 22:03

Reported

2024-06-25 22:12

Platform

android-x64-20240624-en

Max time kernel

179s

Max time network

136s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.180.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.213.10:443 semanticlocation-pa.googleapis.com tcp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 tcp

Files

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 f601ae18384cdc91d148bef866db90a2
SHA1 7f051a5b458c655c44c63ca01d0bfd341c6d3c9b
SHA256 717d78c90fa4ddb7f554ced3204bc835bc048be6957a5fdd1823269fdc6d883f
SHA512 2116eeb96f5b817ee2b9bdbaa9283c9b20aec2380a3b8291be49ca6b82476e831e80b99730565365658c88473c7cef068589b7ecf6952ca394436370515818ae

/data/data/com.tencent.mm/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 66b4dd3ed398d7c5a5eef52f2ca7a168
SHA1 d32e6681f8de99c19176e8d9189f934bd4e2cc1b
SHA256 4b606fa3d2a004c80f81a2366f5b0cf2209a480c138b210ebaa84e9195cfb3d3
SHA512 0fb2f0114f8058adb880afbb11c0ac46c7278212c091d32d892dfac93d70e4fbe2e19e083877ac8f7ca662eba16c525ad4f1fc034dfbb543a8462f06be70e334

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 41e5804d6ab4b682c270f910716c437d
SHA1 fd05b0cce30b6d2e6802174511500cd933d7cf4d
SHA256 a19e8f8d008f17ab6ccd70e4aaa229e939d37e0df890182739a97d6c18ed0114
SHA512 eea1f6e9a3297517bf34d900c5a4c86c9d9289700a3e81aedd90faf400a06c697a07b91c66d14c2f8265bb231bfcd365c3e334096dc75e5ea2b7975a7d45553d

/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 968bd7341816acc7e5809f0b1bf2b428
SHA1 1904d1ab76893c4c2677a62ce15a580ae39eab66
SHA256 9cf5c4734f09d4b3068aad0c832b4d5d4ad9f84981e7617f076578ad6e2d8e67
SHA512 50a5681d35ee61d24c4a27ebd69da4afbf0f2aa6ae5e6c9750dd98143cb4b428fbba5f560760c48f2f5898bdba4cd14b6b9c09cc66347e5e4e7029e3d2fb48b2

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-25 22:03

Reported

2024-06-25 22:13

Platform

android-x64-arm64-20240624-en

Max time kernel

99s

Max time network

188s

Command Line

com.tencent.mm

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.tencent.mm

Network

Country Destination Domain Proto
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 172.217.169.74:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp
BG 194.59.31.228:3434 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
BG 194.59.31.228:3434 tcp

Files

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-journal

MD5 10bedc2c3e0a12f966ecd5be77891453
SHA1 628b4fabb37d2db1f60db854263171ff5f0b55f5
SHA256 b7fa8d2ae5645fde8de0d694bad2fec3e2acd41ed9cb6af7893e6e40cb115f1f
SHA512 383fb89a25fa06893850dfb2a5f9c2e9b62f9a99866401f7120b40a490ad58f9f2ef9898be95a2a87984bbe133bc42cb97fcb04acc605806444bf5da8bd87535

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 b67e5bb21bff92ee92919e919e5323fb
SHA1 f9a5968c5ccb7058802f39b2d0684a2a4ab27f7c
SHA256 54728ebbd1419a319c81c7371bbdb9c5904023a9098edf3d00da07a252bf610d
SHA512 2309beb45eccf73eceeb8d68e6e635cd89b8026cc640581f49615c83ff211a842cf4a11533790ef4535730b4ac1747bbffeae6e8ff12938bb558848e9471d058

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 c438ab056ee6245c03e5fa2b5d86885d
SHA1 dc57425851306e504fe1d92a839690612a52cc32
SHA256 179916b56fd06a34d2d93c576494526fa95f2f8e2e90a5ab669cd08d446a11fa
SHA512 89d39c0157cbe94579646b2043825bb314510eae34633a1f0ff878b4ad0588d0d08427349713e039c815022c463080d3f5156ef7e76f19056cac638494a7f96c

/data/user/0/com.tencent.mm/no_backup/androidx.work.workdb-wal

MD5 d0b9a21eb39a3eb8d58613c96444ee3f
SHA1 9fc71ec316708dec7ec308618f881177edf35512
SHA256 2661fc5b9344f7618ffd0a62e107c186ecd7773c8aba403ecc0e2b503197da04
SHA512 1ba4052d60eb29beee4687369cb27a25b766aa955df0e42a4f23c3a2b91849c4201c313e8927a410295518ef55f205d4914a8b71f58b08c9c4232eb58812c6a9