Analysis
-
max time kernel
179s -
max time network
186s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
29-08-2024 08:39
General
-
Target
ermac_72b3.apk
-
Size
2.8MB
-
MD5
72b3faff0779e1ddaef3a317fbefa29c
-
SHA1
6af79ef669a9250ae2599348f103f772817c88a2
-
SHA256
4ccf02c87de6c0bf718d9f8cdf6c61a9edc909fab1cdd7d497572e30fea1f580
-
SHA512
6a288603b55685d7ce6573ed632f3497f339e7e71e405c9d1fb8dee11a58731bcbbcc137ac3320ee4e88055ee285a5a870f3ebc8258f101bcd83de19ce9543d6
-
SSDEEP
49152:O7MG0EqP3bAU5vB4f/VBiEZEuAI12iQ24Xnviujng53+mmaIHYu6O+c9:+MHP3bvBmBZZEfIAiQ2ebjnUOZ+g
Malware Config
Extracted
ermac
http://193.106.191.116:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 19 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.heruhifosexowe.piwi1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
639B
MD5602419fb01b7107abbbd5c6f47e1fe9b
SHA10783f271060da6a40cf5466e6896cf5823bab35f
SHA256255aad05ff2375486883b28a9319cae15a0f5f7aefa115b8dfb020428391d407
SHA51261deae493b4d3cc0274d7c484934aeb3a9c95f5ad3993078b5ff94b49c7445cd007b4cdc3f539e97e951f3a4c3c0cbf2045b4c1038576258b9e6fa11ae80a98c
-
Filesize
456KB
MD5745780b4c7bd7ffb3e12e203f8cada52
SHA14615d1372289c0468d2c86e07bbe7e914b45d68b
SHA25656ae1eaab2a1c9e135d908490c2c2f8c2ad11073bd433bef70c25729bfec7b07
SHA512e60a8769b2782a62acf6cb114778af9b5a21a119c11e8323b5556b6b2834d65690a98e0ebb35f6b9890310168a06104606688f17b5297fe149477cc6efc43903
-
Filesize
456KB
MD56c28fcb0ec6aed2118c452622ebd6a1e
SHA16b6242cdd83d76f415ccc62d46b29ddd70dfef70
SHA25670c6aa458d1a1dfbb35c77846b67854eb515a5eae80a113450e093e351cd8f92
SHA512507a1b4f0fd6e651caade1acfd4bfdf8baf67d77b70194896bd118975283ec26f7b55a02a8dd9db01e34d8d33b3aca646c111822a205050f4c60673294efa97a
-
Filesize
899KB
MD54705b243f88e10b75353e79019cc3c3c
SHA1d4560eafa95c42228f29f049202a4ce1a1225f99
SHA256875e2d19b70c266d04fff7b9c47947af697aeea1d115f14bc0d79b54d4034026
SHA512a568e2aa5457a58d97a8720c3a15c5fe7176a7f3e6d16435041bf48733209012882a60d782dfb42a7f92dcb9b4e818f601acbca08d9cc3a76089ad3df331a36b