Analysis
-
max time kernel
128s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
11-09-2024 22:05
General
-
Target
abce8bd54a83e5f633f5a7ed768eded74763f881470d1a56a6dbee9545fbb76a.apk
-
Size
2.7MB
-
MD5
84f816175428997fd2050de418ed3ca6
-
SHA1
da5470ac14ed550890f6adeaacfeb01697cb7f13
-
SHA256
abce8bd54a83e5f633f5a7ed768eded74763f881470d1a56a6dbee9545fbb76a
-
SHA512
e18e4ee586a838feab6e28841390039822c3d6d5c2df14abb77534a38acbc83207bb4d8b73679a7e8b0ccd59268f37cfdd83c172364418ce73609930c1d8c90e
-
SSDEEP
49152:/cDtt4uNL5PR1mJ2Lg8C4yW2Z+Ng8DfH8cjBbnyEG3/s:OttPzmX4oQdD8cjVx
Malware Config
Extracted
ermac
Extracted
hook
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.feboramudima.dubave1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
675KB
MD51dd0cb79dfaed9d876b7d13bf0917859
SHA1563c649bf72a7b80ba2747c16e9150b8048c68f1
SHA256920f853645bd2606739ea627d3ca592351f03780b04d3504f7991675b958251d
SHA512f071645891698959a109e476325b6361ef580fbc2ab4b306a2a6c55149e24c4b159d5d6f5f442b08789f14732c826dd5f1edb2e12c88df3c2e2cf9e587274ec6
-
Filesize
675KB
MD5cea17bedea880e352f7971e2a8a529d3
SHA13a76ffad1aea54a54d622b5a345068398b9cef45
SHA2565fa3781affc534371d7c1c256b8f902cfc8c0dd2f94be1ec1bc10111f1365a41
SHA512c499d8c46ac217efdcd27eb4da9a5985962d8ea076ccfb3114dd5c51d118c4ddea96608b030981b6ccf301c0914525f1161d2005de609beef7100eefa100411e
-
Filesize
1.5MB
MD545b8130deaa1b09ac8ab73cffc282cce
SHA11ef7d3bc07c5b9cb31c2e2afcd5e02f8cf0a00a7
SHA256129550d8ca6c44d0137d3bcd4400aa73717491edf183448579ffe3456ced8c86
SHA51249fb2ab47def95deb1a4479fd6df5c1def4d3abeb134e53aba3dea1506e9395d57e72362bd0ba3662604d19fe5264967d7d58f59329ba506c2fde62eed1e6ee3
-
Filesize
2KB
MD5812f70dd664325a127e5b880bc6ab7fd
SHA110d9b87a2780aa2dbc8e6bc325477a7285087d71
SHA2564ad5d9fce97287acaf08a4d8836447c97f5a8cfe30e05cc205f7d12721eafdda
SHA5129772ee89691a9d10dd859533d1076c24ecf6b0e039a431accaeecececca503481a8f1c32a31cd2b57601b5c25472db77b9204980dad8d4c76461c51ba5786f4f
-
Filesize
2KB
MD56b0ba673ca5f06216f37c7f20f3fe6d5
SHA1ee777f7e60ca07eadc95c612349bc94901a87aba
SHA256291dc3b8a1511d601d5c95454bbd3ab6e4f04d2faf2f4dbbcd7d2caed04564c1
SHA51266cda0f761885fdd1e7d61fe2f46a6d75be3f587a31d072dd5e203d12da04d54f4dc2a73344a37421eab775299ad765242b0bd46a105441bd5d49359bb401224
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5c5f552fad0bd7c37cec52741f7cfe30f
SHA1bc64bf769d41cb19ddbc544236906a76e4c1dfaf
SHA2560206674a4b7df8826370adaec926f24bab0a463895b85a8ba816b8857a619895
SHA512ac31c1892150ee7edd5336520dcd76101980babe0a561c093a44252c3270c36776b3a974e2ce15f2f74258f31ec09ccb3fac17edc584d8524b1c620233a35134
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5d7426f54e15ce42d7dbb5d5edeae89a8
SHA15b3b418d738973af89b9c058092db58dc05899c8
SHA256c459053acf6243b2d24c166734b4b3b64d53fbb46fe95fa8547a2d247f6937af
SHA5124695c862d73d600ce4bbf42498c254ab27e6d93d39d88a780ae2d91acbdf392ba865802444f067521280622444743c716e3bb014e17a5b899d20a9a7e6a3aa34
-
Filesize
108KB
MD57e2e7c10714c040cf051cef014a1ddb5
SHA1b99363ffd990435b797475ddcb19718b1dff2c55
SHA2568be58079d9a64a5986e1e8b6837eba961fdd9c70429347257ca7b465362f862b
SHA5124433c09cc8224a20d7012d9f2b01884175d2ba90c0dfbaeb452a15508d86f0315cf64eb16e2757c72b5a5f6dbd9539f92360e91697226f2bcaab5d4ec80a93bd
-
Filesize
173KB
MD521e6a2052ae9a5aa5c91c196406c8200
SHA1c29b20aa7f4ef76a5a922776a5dbf7ba15b121d0
SHA256ef91fd482b3d02a8310f6005394eb33208bef2085a5454d8c57f678c1ee09d4c
SHA51241e5ee08ea49f5a1f47d4dee93d3fbc5beecc4ba99f4b1273d16c373168d00a9c818ee6a53b6b61e83737c13378939f9ff4b7abe4e037b0f98a9268394cf36a7