Malware Analysis Report

2024-07-28 11:41

Sample ID 240627-11q9latdlc
Target ee5f5ebd0297cc3a3bd0f59c8544610ec901fe9a23b02b64b8345cccd96830e3.bin
SHA256 ee5f5ebd0297cc3a3bd0f59c8544610ec901fe9a23b02b64b8345cccd96830e3
Tags
hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan ermac
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee5f5ebd0297cc3a3bd0f59c8544610ec901fe9a23b02b64b8345cccd96830e3

Threat Level: Known bad

The file ee5f5ebd0297cc3a3bd0f59c8544610ec901fe9a23b02b64b8345cccd96830e3.bin was found to be: Known bad.

Malicious Activity Summary

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan ermac

Ermac family

Hook

Ermac2 payload

Hook family

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Obtains sensitive information copied to the device clipboard

Makes use of the framework's Accessibility service

Queries the mobile country code (MCC)

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Acquires the wake lock

Declares services with permission to bind to the system

Makes use of the framework's foreground persistence service

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Checks CPU information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-27 22:07

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Hook family

hook

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 22:07

Reported

2024-06-27 22:32

Platform

android-x86-arm-20240624-en

Max time kernel

42s

Max time network

131s

Command Line

com.datowajejiyili.fatogilo

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.datowajejiyili.fatogilo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 http udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp

Files

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-journal

MD5 75df65f433513f536d34786dd75c67cb
SHA1 dc33b5752d99e0e360495e5451850af3908964ed
SHA256 1fc4a4802913c715a1e037ec652b036652915112bb5aecdcd76240ba761433d8
SHA512 4197aefe472b9981688a71ca61c221a4e2b35e6f67557db1bab5bc1cb519c1f721c2354a3061d8fd21fe1c47bc835f5fc650352d80a7a2ef40bba4bf220daff1

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 6341b3844f27f93b0861b7cefe1d43d4
SHA1 eb16a8a284e38f8ace17eee9a41403caf0b13ddb
SHA256 883f0ddb4f490405a63277b3e1e912e34550f712b5f73f3768a6e91b05268d63
SHA512 3c74d3f9f07182c3b64ece7648e35b94d13bcb60748f60a1e7e048ad0064750b9cae123d725c0a77cf21a3328de7342a59677635049c4da96db488b52e8876a2

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 3a7c9d99598af8e7b8ca7261fe3b1d41
SHA1 e639284f7ecad2a57fd42b88f5f45d3f96034d34
SHA256 80f9f9cc36c713eaa4a0bff52d9ae01305c69b0816e05ca9f816514c98097236
SHA512 edd9c81ad02115182553f553d2ffbed807610238d2265fb1d15d13407a22be4aac38c433121ffb8e50f01a792fe1f367488489f8347cc0065125df88abfa305e

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 9e4d66f497775fa3da2be6c362eaa564
SHA1 2f2eacb278afa8f52a144af9cadf33fc66e69b1d
SHA256 edd6555e4862d782f1239bafed3f44eca32469f430f45881b7b52e356c29baff
SHA512 cde03aeaf040f727542ddbc4c23ca965319b507e896708cfaae8efb47b21711446f59433a86659af208ab98842d43653afcd6ae665adb8b7d30d89a0d6094c71

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 22:07

Reported

2024-06-27 22:31

Platform

android-x64-20240624-en

Max time kernel

177s

Max time network

146s

Command Line

com.datowajejiyili.fatogilo

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.datowajejiyili.fatogilo

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.178.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 http udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 172.217.16.238:443 tcp
GB 216.58.201.98:443 tcp

Files

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-journal

MD5 41bebae86d613fbe7f6fa4a40fbe8aeb
SHA1 755b98afbf030a28dfcf55d3e724e204b7aaf5b4
SHA256 41e9e74ddb6f888b4c8a2e79445bf2a49bc98fa094c3028ebdb14b0a50807aa1
SHA512 c88f1d067a993df8c1e6ededefd7847ca098262eafe3590ce5f5758c763a4aec28cd6e76c1af4e7d45691b9cddff09cdc0039293515333c2e39f20e4d6c78e65

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 338707975ea4b12decad64704d55a0e7
SHA1 30960aa64de67dd9b5e77c1ba9411d3671b3c71d
SHA256 ca3873edd23c04667a9fd60bb51e982d572086deeebec53d61cb014d963d0bfe
SHA512 276d97e622e7373e20f5f76883b66c938c9402828a4ae5bb6b6a7fbf480124b07491128735079a2fd9d5b1779143f0e18962b250baac3aed9b24be45444a25f6

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 a9254fc9f28c037b0b865a6f9ebe6097
SHA1 79fc998919548897df004c1d9d954efa1cc9a880
SHA256 9642ef12e94d007b3504facfb7b689066d9bb3addd57d9adbc2549389cb26154
SHA512 a661bd77a3375a4c4445633f4d56b0f2127c1a7ca5d8547c02b6812a2a563e574e32d257e3d43e871b6f21e565d45b3e74ab79acf1651af6137936dcb53d3254

/data/data/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 be4e72f50dc7b61b090a7c0ebb780d97
SHA1 05f26fd49edb5bb9048df70b2fb8126cc3e2bbc4
SHA256 8b20802f9eb1e4d4fadc396d5bb7044b3510c42c86700861d9cefbce4298adb1
SHA512 2d97a896f68f015d76665bd4b6f6117e9710a9247cd331d8ea4a74cc9efd4a8bf5e389013b5fa0dd040db7fd807439ec0d02b1ae53cc892915e4d082f887584c

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-27 22:07

Reported

2024-06-27 22:31

Platform

android-x64-arm64-20240624-en

Max time kernel

178s

Max time network

130s

Command Line

com.datowajejiyili.fatogilo

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Reads information about phone network operator.

discovery

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.datowajejiyili.fatogilo

Network

Country Destination Domain Proto
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 http udp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

/data/user/0/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-journal

MD5 661a48a4ea023c3a7980cad1d3db3e5d
SHA1 23cd05059eaab073863c9135fa51b996ecfa8b4a
SHA256 52845b30dcd814d07bcdd7d366c7c4205e83410d96c67c7b0b23c2872fbba1af
SHA512 a49eff8e5bea080ed96a4ed5fe6f9ceff25dffed6f5383f674f4837904b6352dee7be5526d26cc7b42d7308ecd512cbce0e8adf55a4a06d3849a49055965b60d

/data/user/0/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 5132720f6baf60129ade14d120359371
SHA1 0e92e1eee12582b1d9d513eb1fef017f673c60ac
SHA256 2d4d4f681bd135a8b9bd25dc23fa4ab0bec1ac2f1fcdae2a88ec3de3b2766aa0
SHA512 896b1803421c0c0768148da406bd457baa3184a21606e6d6c8aa355965a78f02af045789c9230a88cb50db7b158fae09980e7e6719e4d168b19810c78814cca0

/data/user/0/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 de2ae15a9bf513db9dace042bbade1e6
SHA1 1eeacb03a7d9fbed3d41ecf33ba00d746c280d6c
SHA256 37709b212ac5b5607270e9a64472345765993677d4a2aabfe2b5c3a003cb677a
SHA512 ed93e1dbd135a68ad74105065535a7540e80f405e8a080722288400611a3249d01f10e41d3bf33764334e956bdd5d4d6c35c4613fe3504a8a2648076eb298afd

/data/user/0/com.datowajejiyili.fatogilo/no_backup/androidx.work.workdb-wal

MD5 1a705fedfcc23e979b952f9b3ba15151
SHA1 d7cae7738c861fd7be419a50d11d0c07f1bc65ab
SHA256 34d7f9afad9b5589940f2848afbd05897e3e9a2eaf295d264e2311da7e9564e6
SHA512 f3a48f6d5c5ad5c91c140bc84c529b184a42a40f15035a837cd8d5623308ee59d83f9872e1e639c6d936e8916c95fe22663138ea368d5533f8add52f71470af4