ermac | 4f2c636d1d0adb6f1a718f76e113efe909a3a289dd67fa692705d28b82881446

General

Target

4f2c636d1d0adb6f1a718f76e113efe909a3a289dd67fa692705d28b82881446.bin
Size

1.1MB
Sample

240625-1yjrqsydmp
MD5

f212518786a7306c309982506f42aa20
SHA1

3e7f35d81476dc8ef5277207c00aca31712586c3
SHA256

4f2c636d1d0adb6f1a718f76e113efe909a3a289dd67fa692705d28b82881446
SHA512

bd06b471c4ad1067a0c57387dff651b63dfc0bd3063dc5c7e790828a0eebdb39fa9c0729d91fb885883cb717714af85cff7929046940ddade61abe7aaa55dc23
SSDEEP

24576:PO7Hvz9zywcLJLXNRmdizstXcu4FtluoGyDJg/TFIIo:PKHhzbcLtXN4AzsCFxuGDJg/eIo

Score

10^/10

Malware Config

Targets

- Target
  
  4f2c636d1d0adb6f1a718f76e113efe909a3a289dd67fa692705d28b82881446.bin
- Size
  
  1.1MB
- MD5
  
  f212518786a7306c309982506f42aa20
- SHA1
  
  3e7f35d81476dc8ef5277207c00aca31712586c3
- SHA256
  
  4f2c636d1d0adb6f1a718f76e113efe909a3a289dd67fa692705d28b82881446
- SHA512
  
  bd06b471c4ad1067a0c57387dff651b63dfc0bd3063dc5c7e790828a0eebdb39fa9c0729d91fb885883cb717714af85cff7929046940ddade61abe7aaa55dc23
- SSDEEP
  
  24576:PO7Hvz9zywcLJLXNRmdizstXcu4FtluoGyDJg/TFIIo:PKHhzbcLtXN4AzsCFxuGDJg/eIo
Score

10^/10

hook collection credential_access discovery evasion execution infostealer persistence rat trojan impact stealth
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3