Analysis
-
max time kernel
52s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
29-09-2024 22:05
General
-
Target
f5b14d5b068f5f0b4ff0ce54ebac9d16fe57d1dfbe571441d11f8ad014d38ae2.apk
-
Size
2.1MB
-
MD5
32c53b6ff8f3f834e554321b385810e5
-
SHA1
b3bd943262572ce0705fc8e478cacaa5bd62f6f0
-
SHA256
f5b14d5b068f5f0b4ff0ce54ebac9d16fe57d1dfbe571441d11f8ad014d38ae2
-
SHA512
8ee411658b8e92adabcbdfbf614caeb93f89151468d1669228415852bb909180dbd4982773d5cf0926c24f7ddbfc8f6a6b9931e321c9b049d75c41540f333ca9
-
SSDEEP
49152:zkM0799ib9i7ARHg8nCUpUm4g6XGv8pyw8hrHYxEtFlL2:wM07uUuCUWpsA+hLYxEtFc
Malware Config
Extracted
ermac
Extracted
hook
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wiwolasamiwa.remamiri1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59a196f203ec96ca1ea5b72e64c024aec
SHA15b8d6a9e5054a6b7d9d284209d724429ee46cb86
SHA256884668ed4d12316f4f1698b7e519086b42f1afca7768827f26a8ff1c4e4bc55a
SHA512cbba0d1ec02ad90aa66514a2202944e021c3ed3f58487fc65d5392df2af22e4d34450e73dd31601d7e38fc6b63fc0cd5f41e456b4e01e8671f51a6262096e94b
-
Filesize
674KB
MD51430239d90c4327ed144c387eda34855
SHA1603a1489f4c358b8bf87cdc74660e4a82b869c09
SHA256f37b8b5f098f87294442ea894a3fe91043bfed45678540bf0fe38aa80c2bc983
SHA512c75c0c5c485da5756bd2123fe0655a5ccfab46965b22d31ab6c96c20bf98aceb7f9035f75d993e0290f3e691b584398143f3ee362400c92ecf055143ea0a0fb9
-
Filesize
674KB
MD56fe1776cd523d56d09d0d5d78751492f
SHA10337efc5a8b75a1884a9d0aa351548ef815a6707
SHA2566f2eeb8cc392ca49f02d14b875687b5046162a3846b70552e65c46e0dcf0a3e9
SHA512a609e48e625ef3e61777b68971eb299696a46aeb1260413d13bff77e7ac2f19aa7f4f68fba3f5a65d1cc58d36dae8af7b056f5b9c25db748b4a6ff110846ab92
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD521c7b078a7b589a570605eb2fd399065
SHA16b4e5c6f0880eb8a86eba80bfcc6b4ea7a07fe87
SHA2568de1b8518207c6e93ca76c57540f814ad29ccd824d8dfaa9a82113d64e2d47b6
SHA51245b466ec6ea179b9648c2335505d015b3a2d8929f2818103a5565877d01a09d867353e1e40d5e30c4a95fde9e4635e602b5d4f904cbc2099aa3cdc260fe21de4
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD55b7114596ca0f0442757cd64eaf1a032
SHA17309dabd1bda872af395313d2e9b6c75638111cf
SHA256558217383ff97d6e1ed546fa1370e01f42ffbadcdf25bbdcefd5d7b982ee9e92
SHA512381bb3b0864af6b92e20a1c4881b2361977c0a2b9d774a4fd85e6cf2eb2e38de944443d6a165f9382718d38fe03b9ae6e500894f130eec61559adc0a6f3100a2
-
Filesize
108KB
MD52174fc638822631b7c7aaf47777ef8e5
SHA1a79e2075f778e1760d484149396785fdae15b685
SHA2569e3e8b54b228d9bd26b52f87a1e7ec51a8be6f92f25e0de73b59c0f7e5c15f7e
SHA512d9e6bda10ed2030000b431a24931d6c068612f12d1bab7ffd6c8521f6c346e8798ee840d9dec2049bdad37cc0798a3b624a106915eafabbafab508d22a25bc27
-
Filesize
173KB
MD53469694cf3b97e1c697b5a91488975eb
SHA13b1ddb6fc38df6d4f3667d5e131ccbdc0cb6d426
SHA256768909ccd24286dba84880d2d1e20b00c491f9420cf34372301e4f61b11b13cf
SHA512b2abd82ea8c576663d6114651bd09785e55a77b922000272acf831ef2e937f003ed717d357bb53abdd682b59dfc6a0a8f6f76ec585aa6b24d8282b0fabe93d26
-
Filesize
1.5MB
MD5342a8740740fb866f441f4e1e6c5c66a
SHA1172073e7d97a040025fd2a80ebcfde7b7b65a573
SHA256264d2ce4a7c6c59353086bc006d0c7cfecdedc2d2926711cadd1543762991581
SHA512640726dbe29200cf7f5daeab8d678e2664f9e672d746f630ca5aab76d2d4e189e5bdbb2552f5650755694e744d7f310418ab30eab1ebe3cc01f7d6c4ea177461