Overview

overview

10

Static

static

6

7933686711...4c.apk

android-9-x86

10

7933686711...4c.apk

android-10-x64

10

7933686711...4c.apk

android-11-x64

10

Analysis

  • max time kernel
    176s
  • max time network
    181s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    02-08-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7933686711fc3680b5f862a3502b305222fa1f35b0a8c0ebae4d9e2eef3c584c.apk

  • Size

    2.5MB

  • MD5

    a569a01fc6f8d426236187b2314aa3f9

  • SHA1

    4f33c0004ea889f8a55647c75b0132c05e00d22f

  • SHA256

    7933686711fc3680b5f862a3502b305222fa1f35b0a8c0ebae4d9e2eef3c584c

  • SHA512

    f0bc892c71382d42953a754d7542488c70e02238b8f46eb77ee7a1fb0f4033c5d928f10b64e0a92f9a61abfddda71c0962d289f150e243cfa32c817742396abf

  • SSDEEP

    49152:aayZAxBUKQ42Y3B+pB6qgSh93WaosfKGn+AoT/jVyHL44dT2P:aayePUKQ4/ApBT9GGf5ncjVOk4da

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://45.66.231.11:3434

AES_key

Extracted

Family

hook

C2

http://45.66.231.11:3434

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kakao.talk
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4245
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kakao.talk/app_habit/eM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kakao.talk/app_habit/oat/x86/eM.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4270

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kakao.talk/app_habit/eM.json
    Filesize

    799KB

    MD5

    2566ed2a38c03e21f875354c60f3be6e

    SHA1

    95da10d4c7ee44aaa7ac367ffbbc6463a1477e92

    SHA256

    9eab0b7ba737de42c39b68adb86e653f2e42cb417f5221426860133e33c2bc2b

    SHA512

    b9c61b12ca8ac88a7d53246453acaf70c7314e13f49f1d0636cda46662fa4fd54c915a0a8fa99b8c6c6a913cf60cf6edaf94e44a7cf160f30a3e3932cc5b24f6

    Download Submit

  • /data/data/com.kakao.talk/app_habit/eM.json
    Filesize

    799KB

    MD5

    1e00e7edcd838a5a700f183559e12dec

    SHA1

    ac4baca009cf61dc812b3205c17c081d5e25cccc

    SHA256

    d339cbd7d1bd47914858be08e624780b267eb5187b48700a6841dd634492712c

    SHA512

    034eeb96caab8c98f993bce721e73f985e43df8b902117b8938e16d9e4c67cb3cd6c413d94529fd3e63e49a1c807383f44da89dc59c67b5e21543897a3ef97ae

    Download Submit

  • /data/data/com.kakao.talk/app_habit/oat/eM.json.cur.prof
    Filesize

    2KB

    MD5

    0147dc722ffc7ba2c8aa5910ac4d984d

    SHA1

    95e182dbe0e0bdc48004927510a4fcb00a25a4c2

    SHA256

    0075858798244398bf378d02aee95861294c045beddb1f4765974ace549dd105

    SHA512

    e94a551cc9c7397946dd4cdf690231fbdd21b29f616d2d77832b594c9b7b385731a5fdc37fe70895d5b18f7900d104ae456b4ba6558ad139f3ba68ef4e406c0b

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    dd137f01d178dee427bd2fa94297eed0

    SHA1

    f557fbf78f6c48625e7c4f8799e882bacc70d863

    SHA256

    c67b2fca90ab11efd1dd9274f47549b845256c8393304ed5b14c65d4d0a1c4e1

    SHA512

    cd00440552012ca3b7259d32ea14bc2491b60c972628341b05aa17e40c4582319f9526d634262bb4c66e1e64fd852f3db87a03bb0d217ac891916550aaabdb89

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    2a6f6ca7e293aedfab3d827f0a502ccd

    SHA1

    ce46faa00d5129e4d1244cc2d1754b3d26b66082

    SHA256

    355535460c0bd0297a31d4694b97266c19a795ea0c4235d7aaad85ac9d9bea57

    SHA512

    5aef1e86031d536b07696b2c2521e55ab674b4b37103cee25c132a1df09b743be4426941228128b229d9e5ee27c921217e30815131fb40407a312c73d4ff979f

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    b59e141a055c20f86e3a724ac05911e4

    SHA1

    e32402ca41610309ac2c8e0d498b96b5f1d52751

    SHA256

    3a9504428bd6f14e4d053358c6801a18c2e602462998686e81006b526c8c3be9

    SHA512

    50aa0ca3907fcedcd3678970276045a74b9f7656d921d34cbfb2f12d2611d19f7c8788171157817798f07052df5c0d99103fbdd8a3ebb85f102bb03cf6b65b5a

    Download Submit

  • /data/data/com.kakao.talk/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    41fd31408de984156948233fd84d551c

    SHA1

    65c6a845f6e5538a2d13db81fb1b4454e2c1b4a5

    SHA256

    37eb313799ee89dc08cc1b43ad1b59b0e36b4f41c95f3bfe6ad31ce60ffc6f88

    SHA512

    ca98e32884006ccbd534ca42d3beba726851a7cefbe374fb48b6db5eddd25159a26b9da0f9def69c271d3489e52e06b79849ddb7952368d09e7e49a2d0e62e4b

    Download Submit

  • /data/user/0/com.kakao.talk/app_habit/eM.json
    Filesize

    1.6MB

    MD5

    c7531aa43c1f638a88a399b87b2da8fc

    SHA1

    9b04fb9d75166af69f48f0792234e7506489550d

    SHA256

    e927438f750edebf103de1c60d6425850d78b120ecb321f3fc2b5b20478ed5f6

    SHA512

    dbad6142daa08687361f4d76c75fec76b5f3afe5657be3d3d8a0283dc21ded45933bc78653e5ecd640ef61744de56b437d2a94427449b22fa032fdc500728c92

    Download Submit

  • /data/user/0/com.kakao.talk/app_habit/eM.json
    Filesize

    1.6MB

    MD5

    2d2dfb668a71da2c6bf0067e53da9d49

    SHA1

    4f50d92424d052c3fbe9ddec343d19bfe59a8ba8

    SHA256

    dd3d706fb16260c8d735bafb6f05a84ad4d9f1ae2632d7625a648327f189de42

    SHA512

    771d307de6164cc25088b603ef5281fc3375ebc5d31aa3bf6a6bdc7d3e18bca8c54dc6c4f935eef8b1c3623a21c08d6951e62e027fbb8795559819eecaebc48d

    Download Submit