ermac | 1d39280b3c7f0a695d260d90637cda6a866da1fac8c26d4d915be87333393b31

Analysis

max time kernel
41s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
19/09/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d39280b3c7f0a695d260d90637cda6a866da1fac8c26d4d915be87333393b31.apk
Size

2.8MB
MD5

2d07cf8981d64375694a1e7e773f1e80
SHA1

74122a28d66127fc49f16bcc725328439a354a2a
SHA256

1d39280b3c7f0a695d260d90637cda6a866da1fac8c26d4d915be87333393b31
SHA512

0d44d1323e9d1a8d9e049fc06b210549c3e2c9e3c481a4745236aaf757a8a8a23754506c167a64390076215be1a6db55536443b410ec8bf7a815790ea9a297e8
SSDEEP

49152:IWEfZ0JYYzgapbtSJ2Wg8lGljOsw9VzrNXgrDlAwSxLs9qJP:3iHy5tSuljDwbzBADqwSG9qx

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

ermac

http://91.215.85.23:3434

AES_key

Extracted

Family

hook

http://91.215.85.23:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4336-0.dex	family_ermac2
behavioral1/memory/4309-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4309	com.zorikofidiyi.hiwade

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json	4336	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/oat/x86/wWe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json	4309	com.zorikofidiyi.hiwade

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zorikofidiyi.hiwade
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zorikofidiyi.hiwade
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zorikofidiyi.hiwade

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zorikofidiyi.hiwade

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zorikofidiyi.hiwade

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.zorikofidiyi.hiwade

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zorikofidiyi.hiwade

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zorikofidiyi.hiwade

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zorikofidiyi.hiwade

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.zorikofidiyi.hiwade

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zorikofidiyi.hiwade

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zorikofidiyi.hiwade

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zorikofidiyi.hiwade

com.zorikofidiyi.hiwade
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4309
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/oat/x86/wWe.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4336

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json

Filesize
677KB

MD5
d0022c5aed5e8a005ac332876602fda1

SHA1
84d87b31bb0eeb30ac27e1649ee50d0d7740ebcc

SHA256
c3a1f26ad681ab20611d063aa80aa71b49b1828c6e355f42420bec0af85a529d

SHA512
6efab7adb2c3577b962a57b11488b9daf08df2f8120982b0b39e953c3c50b9e7a4b08f4630307286aaab79559a72e5168a33cf6466759b0dbe81ff43e9b603e0

Download Submit
/data/data/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json

Filesize
677KB

MD5
2b3cdd3a14bb06ec94b46cd1f3170033

SHA1
f66e0fa614a1ac329de7e0ef652c821292885894

SHA256
8bb09de4373ffdc4b12ba172c986e3756af0ef942abb5d0bdae059826ae1aabb

SHA512
ea2ca765466fc3c6f8090eed60d9800c7cfefbbdf2ffa98ae8b3a47d3a1a6d2078c7f5f21d1c98fcd57c54ec37b2881b4f74e39aa085460ce127af6ff736afc6

Download Submit
/data/data/com.zorikofidiyi.hiwade/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.zorikofidiyi.hiwade/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
f1023eaba80d67876002a6c819eebebb

SHA1
d499fe0a2789b7cb7f77c5092c78f1cf93df7f66

SHA256
998767f0a9fd7bab806aa48e7bcda57e379646b19c763228ad23b83575144f1c

SHA512
96dbafa19aa4e56170bccbc13df87fe5a90b37ebf617250a3f2200b9b5f18e756bbe7dcc6610e7efbf64aedd66bfa5da7d168b7c9f545aff10779b1c627a0c7a

Download Submit
/data/data/com.zorikofidiyi.hiwade/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.zorikofidiyi.hiwade/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
36a1faa037109371895102e343b0a112

SHA1
ebf05d444496b1fdca4c70e1de0af6cc3017e0c5

SHA256
5bca3be804d0bbf0bd0b5de13ac6c98ea4da1a8b2370abc4e1ca5fc98d197d41

SHA512
69c18242799434a1a72b450ef2d8c6b615fadf143dd41ea2820be14af1afab8563b8dd258f69e1f5d8500fe74b56bf48d04f9a2ca4b5356b98d9dee74d630578

Download Submit
/data/data/com.zorikofidiyi.hiwade/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
714ac429b3073ed6d72cc65526b78d4b

SHA1
c1730b2dc59dce1f6bdd39906b60ed094cabd917

SHA256
0c66e6ba438381e15aa8cd6ae83e8a64369f39d15c52ea21acb65e8306615c69

SHA512
3a0c54d751cf65c6fa66b5d6fac10e903c3bfb3d5118a91c6e5d1ba2f4b4214de2bafdcd9ffec849fd0c56775dc36cb8441046bf7881986d8473be929bc3ec19

Download Submit
/data/data/com.zorikofidiyi.hiwade/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
bc0b48b77ca394d7658da7b1be8b4eaa

SHA1
2f033b61d2be89483f87f6e9442499c1ec47801f

SHA256
cc87e07435f8384c6b0b444b3ef816aebcc3d10dee96025a5186d6ef2c45608a

SHA512
0967296205deb396fb2a6ffa3dbf851c986aa7b621588c365f525bef680e99d0244849a2d50d3ec10e5da96c53eb70a7449a50555b0d2e8901a1c91a44509056

Download Submit
/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json

Filesize
1.5MB

MD5
29069f55b5eb2f44c1cae0d42730884d

SHA1
00668f8a3d58cff7e6f960cba6127148e0c26f5a

SHA256
c8b03cb7e24dd70b01444fa6f3efdd1f210e3a61733248ef27e6fafb0e86babb

SHA512
3c31b9d12ba8cf5febb6bb5ec69d68e7d8da08db577702a302749dea8c57fbcacb22a1bc476da550f069d9f789e9b94dcc333859cf2d13b037a67bfa4044fb29

Download Submit
/data/user/0/com.zorikofidiyi.hiwade/app_DynamicOptDex/wWe.json

Filesize
1.5MB

MD5
a5aff0f66447000f52eeffb2036fdc7f

SHA1
de6922fb5f7cfaec1055b6d840912c5814040f33

SHA256
461e1d34e866631b96b1b3a0400baa5e3d90198ad7379d78175e5f854e85819b

SHA512
fef1f7c9eaead9e45464d81a0ae1fbd9c223d2b60d450e740d8d9c74c3a63946068f0875e169fb503241019faf910b41d434ea49ff6ee2a5ffe1412f942e35f3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads