Analysis
-
max time kernel
175s -
max time network
186s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
29-08-2024 08:39
General
-
Target
ermac_72b3.apk
-
Size
2.8MB
-
MD5
72b3faff0779e1ddaef3a317fbefa29c
-
SHA1
6af79ef669a9250ae2599348f103f772817c88a2
-
SHA256
4ccf02c87de6c0bf718d9f8cdf6c61a9edc909fab1cdd7d497572e30fea1f580
-
SHA512
6a288603b55685d7ce6573ed632f3497f339e7e71e405c9d1fb8dee11a58731bcbbcc137ac3320ee4e88055ee285a5a870f3ebc8258f101bcd83de19ce9543d6
-
SSDEEP
49152:O7MG0EqP3bAU5vB4f/VBiEZEuAI12iQ24Xnviujng53+mmaIHYu6O+c9:+MHP3bvBmBZZEfIAiQ2ebjnUOZ+g
Malware Config
Extracted
ermac
http://193.106.191.116:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 13 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.heruhifosexowe.piwi1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
495B
MD5ae47e2513f30f532d35a7fc53611c908
SHA108ce831416c108219c9de63d72a7f88432c2bc0a
SHA256bfa5868d3cfa6b24b7daf0b588ecaecde074d1a29078b4707f56ae94d5c0b3ec
SHA512c75b69ef139c2ecb013ba2df783dc0e43fe64f8cdf5ddea6fbb278b47bc750aa1337d057b108575882510c648fbb602e1fd662c341f99d2689f1a3f41b45aeab
-
Filesize
456KB
MD5745780b4c7bd7ffb3e12e203f8cada52
SHA14615d1372289c0468d2c86e07bbe7e914b45d68b
SHA25656ae1eaab2a1c9e135d908490c2c2f8c2ad11073bd433bef70c25729bfec7b07
SHA512e60a8769b2782a62acf6cb114778af9b5a21a119c11e8323b5556b6b2834d65690a98e0ebb35f6b9890310168a06104606688f17b5297fe149477cc6efc43903
-
Filesize
456KB
MD56c28fcb0ec6aed2118c452622ebd6a1e
SHA16b6242cdd83d76f415ccc62d46b29ddd70dfef70
SHA25670c6aa458d1a1dfbb35c77846b67854eb515a5eae80a113450e093e351cd8f92
SHA512507a1b4f0fd6e651caade1acfd4bfdf8baf67d77b70194896bd118975283ec26f7b55a02a8dd9db01e34d8d33b3aca646c111822a205050f4c60673294efa97a
-
Filesize
899KB
MD54705b243f88e10b75353e79019cc3c3c
SHA1d4560eafa95c42228f29f049202a4ce1a1225f99
SHA256875e2d19b70c266d04fff7b9c47947af697aeea1d115f14bc0d79b54d4034026
SHA512a568e2aa5457a58d97a8720c3a15c5fe7176a7f3e6d16435041bf48733209012882a60d782dfb42a7f92dcb9b4e818f601acbca08d9cc3a76089ad3df331a36b