Overview

overview

10

Static

static

6

8192c81336...c5.apk

android-9-x86

10

8192c81336...c5.apk

android-10-x64

10

8192c81336...c5.apk

android-11-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    129s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09-08-2024 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8192c8133604c35c8494ca887b6df177f72bc90a32f4d53ed0d51c4db6ac24c5.apk

  • Size

    1.2MB

  • MD5

    7e1271651e9bc10630abc95c19cc2226

  • SHA1

    b55fa625c10d53bbbe7ca88e5ce6e5aae1b97ce6

  • SHA256

    8192c8133604c35c8494ca887b6df177f72bc90a32f4d53ed0d51c4db6ac24c5

  • SHA512

    d878973ba53cd0b19ab5935cdf38556d9e880706d9c453f2b8173aed93949b87d20d9c128c90a86290890f05164f65a4bb367aa7bfe452e2449006022538f02e

  • SSDEEP

    24576:7/cg/uvb75nkEFqD9jy4YIX5BZ0KxYwQYNZ2j9r5AdXR:og/wJh+9jy4h7ZMUZ6UB

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://auvzmashinadx.xyz ; http://auglogvnja.xyz ; http://audkzmzc.xyz

http://auvzmashinadx.xyz

http://auglogvnja.xyz

http://audkzmzc.xyz
AES_key

Extracted

Family

hook

C2

http://auvzmashinadx.xyz ; http://auglogvnja.xyz ; http://audkzmzc.xyz

http://auvzmashinadx.xyz

http://auglogvnja.xyz

http://audkzmzc.xyz
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yezatabefuhe.tozeci
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4250
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/obb/com.yezatabefuhe.tozeci/dp/dp-a.a --output-vdex-fd=42 --oat-fd=43 --oat-location=/storage/emulated/0/Android/obb/com.yezatabefuhe.tozeci/dp/oat/x86/dp-a.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4278

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yezatabefuhe.tozeci/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.yezatabefuhe.tozeci/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    a0bd599e30a5db5e46b534c783dcf266

    SHA1

    dbd75f649f6feaaa97dc6e1e1718788ac9776c14

    SHA256

    d1afe3ce30f7a4730f73db59328443ae30a9a0baf2de12ea9b40a5696dbf74e3

    SHA512

    b6c5c58a43f48744300010b5b999f692bcfb8d568c5fa7a54f6903757b0069bf822ddf0f67a07040291ce9c3af7ba2f19f4f90b915ce5a678a740879e79e74e0

    Download Submit

  • /data/data/com.yezatabefuhe.tozeci/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.yezatabefuhe.tozeci/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    669618a1db810621cd2bd295b80084d0

    SHA1

    f066ef18f0587d2dcf486430e80bdda1fc2e7e38

    SHA256

    b988b14098a83e9e2db16a23dbecdc513463f671f30cc07bc39ed4fa0b0f5c68

    SHA512

    a73fdedf1949f4c8d03c4182767f73e14f743486580a2fb4390699f8e9137ee971e8e07ca90fb601daca060e0d5fe8fc8b7831129217a28cea555faf9da23814

    Download Submit

  • /data/data/com.yezatabefuhe.tozeci/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    b5fcba5973ea198f1b66e627e2a9c6cc

    SHA1

    648982bfdc03a1ed65800c1e55efe81da8da397d

    SHA256

    2e450e34f23625f51125c8c88c012965dc6ab69b8f642facf8ad75b24dabb33a

    SHA512

    be30d096d4f113cf96a59deaaf67a952ab148a6c8a8bcc329df2736294030c53f4d036f44ac09c4133be817754792331a94faf6771aa20c8efbad7b8a0568bb2

    Download Submit

  • /data/data/com.yezatabefuhe.tozeci/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    80e9d95121cc8c369af8a9bda978b0ff

    SHA1

    d5bbc2c380c12c87e0aeaddbae23f7c4f9d49499

    SHA256

    450684c0c6cd0b56adbad575a92f6fd1f4873b099e4d49c56674d60e485f29d1

    SHA512

    8518e68b03dfdd3cbe15e922954594fa9cd049775fec8157de656c66723979cbae7a50c2ede7563b8baa801ad833b5f7bda18ab20d59f75dd559af6e2cf45f96

    Download Submit

  • /storage/emulated/0/Android/obb/com.yezatabefuhe.tozeci/dp/dp-a.a
    Filesize

    1.5MB

    MD5

    52c99cbea7f93afc7af6f8a002173e4a

    SHA1

    81aee4a29a4868a087cefe80df0278f8155afd69

    SHA256

    9fd376afa40abc17c13375e9465b0c7fc24240458dbdaa328ee5111834095f1a

    SHA512

    fa36edc6ce6ec8a54128ad5a654026b3b66c093103f4d2fc806888ff1ca33eb857533c58c8b9bd680f3b6a21dcdcb2e0e076a850c6dbac44b1e97c43e15a9bed

    Download Submit

  • /storage/emulated/0/Android/obb/com.yezatabefuhe.tozeci/dp/dp-a.a
    Filesize

    1.5MB

    MD5

    424e0ebfb52e654faf34f32813bf0d90

    SHA1

    50d7b256ed53a4d320721e1c6d35cac2edc306dd

    SHA256

    9f3eac5a0af58bee8eb8191e1a80811bd82689b8ace18a0c1baff276ad303987

    SHA512

    2c4d22501e56816bf90faab80cf28e1cc2f7a4e3335806b8638cda96322680c61505920c935d2ce92fd2f16093dabd7b57a346428dfcb394ef7ca55c657a7bf6

    Download Submit