Analysis
-
max time kernel
131s -
max time network
156s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
17-09-2024 22:05
General
-
Target
2d66d00796b1a7e99cc74baceea6d7a7be12cf44150f18d4aa3dad1ecdbd833e.apk
-
Size
2.4MB
-
MD5
f98114dbd0f96074f1b567f200caf682
-
SHA1
30eb7a26cf396b4b7563a06e496b94bc15a28cb3
-
SHA256
2d66d00796b1a7e99cc74baceea6d7a7be12cf44150f18d4aa3dad1ecdbd833e
-
SHA512
53c8112404b4fe0f9dede084349c193d96555c91269bcc6cef91c3a77430f23d225970e3598daa610596b1ed3730eb7edd41a0c126c8800c5b8b0293cc23da06
-
SSDEEP
49152:T9QMCgUUhbJ2Ng8YTCB0C0MCDevQnfV7E46YzeUAl:AUhbhuG5gQf5D6zUq
Malware Config
Extracted
ermac
http://91.215.85.223:3434
Extracted
hook
http://91.215.85.223:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dilofakigiyego.xoba1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
674KB
MD533f27e651a792ba27bf44eaf233027ef
SHA17c5a0014bdf69abbfa2e444b69a7389fe6c71012
SHA25638e70f5fbc45fe903c7db2d1e5ecf97c46d5a5eb701f52dd4d5da866721b2c24
SHA5125e7da6b69590fd6fb231f0d3176f41588c33e6038cf2c2c0927a3f7e0086b4f083dcd1cb8c3a33fdafe6c9e5dadace8b6aa9bb2272249cebbb99aa592f4a8391
-
Filesize
674KB
MD5cb8b4c114fe73703b97d74b82b74b2c0
SHA175f1973914ba3b9824d82272350be15bdc5d4635
SHA2561b040d477677e76dea63b708e241e5b811e4397662dc5359d701080d24ceda81
SHA512687e80b37106a55a7bb0a1945b88f39e75864a217685b5c46dea7e2a404fd72da87dfa42829fe0baf8485c7de0ee4d0fec2e167b6b27aa670b236680e08f78ac
-
Filesize
1.5MB
MD5368a6ccc318cb809c6b389b44f7ed989
SHA17ea443fd9809e9571836da932d23570b7a819a13
SHA256c7df91fa2401da72ff52af5258549c4309c1b6ee26908ab3be81e187d8e03156
SHA512b5975bb1e97cbefd2d15124a38dd2a4183c8713b974ca975f4bd6d9f3847a47e93feb516b6d1c3f4acdc59f5eddfa1b0de953d65739b3fb4043c05a3779031cf
-
Filesize
3KB
MD5a7ee40c60e50661eea994ecc5b1abc22
SHA1a9b120ec0d5021df8daba6ea82facf0e6133667f
SHA2566f12f1a0e193f1b18c050bb8ece9d465620caea125150b4146de99b7e42f1d68
SHA51230d99d0d91d977f300fc890b9001d536e62e92074b71d1f58aad8171b1d10e8fd48cd3e5527710b68f1b5c4235c05944bb1872f72267b3290c7431e599459479
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD569d13f164aebac0d0d364be51a884943
SHA134eee823d1d05b77a76c714cfe88a0d7fce46bae
SHA256207c64a9b0b5d1876452c48c2a842fe8aa766219ce4293bd4c616cb721b909b1
SHA512719ecc1727937a3380de0f6611f7118ba4ebb997bbe93770aaac4ccaf3de415c4da5b7dd5f3de2d1333d8f62d793670e7f8e3b19c17d00d981d62aa3be49b7ea
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD59fed1081dd494ac78609a9d3eaa726dd
SHA124fdf3346153bd07e20609d0b3feacf61ee56b7b
SHA2566aa511313c975d58fd66b7a65256959316919f86fe21091edc1313dbbca6d2d9
SHA512da43c2fcc1a491252de2aa3520dc7c9cf36a5d1133aec99d255fd12be8fbf293d600ba93bd4af0055b80b061fd59b59808b39f7a5302b30fc3eaea191759dbdf
-
Filesize
108KB
MD5e28334f2eeee78d7d20decdcaca633bb
SHA170dd7ae0285cafa3becb74c73aa9af126b5858f4
SHA25695f4244cf4c4e204982514e9f87020a5d0029bdd39d4d63026e84c4247a85463
SHA51236e57f7639efa5d34c1e9280691aa68fe75cd28162a32767f2e851f2a2cba9998fdb5a1779f75419f1b4986c079decdecbd3fba1705c3240f1213dc94ecd5491
-
Filesize
173KB
MD5434745cd5aa0071a262dddf6f3e0ebfd
SHA1b68aa01a224d3fec1a413990dcdb5f60f66d0857
SHA25639609538eec5f811a1b91efcd6f6c44ed9aaa9107a96ac59403cd94fafcc4bb5
SHA5127731ba5536515a5fd62de8a24f1e957c2fd03bd6cfba5b59ae4f596a64231c763e916b5191be54bbcd0d7ba688948f76c77f681f676aedc075aa5de913314dc3