General
-
Target
Actulizacion apn CLARO 4.5 LTE .apk
-
Size
3.8MB
-
Sample
241005-ydtebszhll
-
MD5
a9246e1f6b201f068aa62b2aa40857ac
-
SHA1
a80280dca769280a18672a07cf43ac7a20c8f3e0
-
SHA256
8dc565bad0cf1aaf70cea40d04bce25fdaf9738f5c73228ee1da6118df81db25
-
SHA512
8fc79ad790f526961e41e232f86c8bd4e5a96bab2407af6b44a74e2464a738979bfa0a7344961fa35432cb76837a44411522759949b6200673ad2c5260b1ae9d
-
SSDEEP
98304:ngq71j6kQIgm1vQtzEtQG1jrHUgVUQZ23RWHhpKYYxMj:gqRj6kotzix37FYq
Static task
static1
Behavioral task
behavioral1
Sample
Actulizacion apn CLARO 4.5 LTE .apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
ermac
http://176.111.174.221:3434
Targets
-
-
Target
Actulizacion apn CLARO 4.5 LTE .apk
-
Size
3.8MB
-
MD5
a9246e1f6b201f068aa62b2aa40857ac
-
SHA1
a80280dca769280a18672a07cf43ac7a20c8f3e0
-
SHA256
8dc565bad0cf1aaf70cea40d04bce25fdaf9738f5c73228ee1da6118df81db25
-
SHA512
8fc79ad790f526961e41e232f86c8bd4e5a96bab2407af6b44a74e2464a738979bfa0a7344961fa35432cb76837a44411522759949b6200673ad2c5260b1ae9d
-
SSDEEP
98304:ngq71j6kQIgm1vQtzEtQG1jrHUgVUQZ23RWHhpKYYxMj:gqRj6kotzix37FYq
-
Ermac2 payload
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1