General

  • Target

    a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e.bin

  • Size

    1.8MB

  • Sample

    241013-124lbavhnj

  • MD5

    22597c6ac1c89b9b31a1c135b613a645

  • SHA1

    2192ad0149233dd8477babcf64bc643a5fca089a

  • SHA256

    a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e

  • SHA512

    10a5bd408d886d702773aa735a2e17dfb3e398b90f47e9c84224b46b04848c5271d1be49d5b042bdf9a064a1e0187a2efad105ec5ceb48a78fabbc36a4770074

  • SSDEEP

    49152:Zg/94Z2SrHmjLKxqobYnc1Th+tompsZKnnmTD28o2a3+glD6s:hHmyxH1Ty+ZKnncDoblD6s

Malware Config

Extracted

Family

ermac

C2

http://154.216.18.158:3434

AES_key
AES_key

Targets

    • Target

      a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e.bin

    • Size

      1.8MB

    • MD5

      22597c6ac1c89b9b31a1c135b613a645

    • SHA1

      2192ad0149233dd8477babcf64bc643a5fca089a

    • SHA256

      a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e

    • SHA512

      10a5bd408d886d702773aa735a2e17dfb3e398b90f47e9c84224b46b04848c5271d1be49d5b042bdf9a064a1e0187a2efad105ec5ceb48a78fabbc36a4770074

    • SSDEEP

      49152:Zg/94Z2SrHmjLKxqobYnc1Th+tompsZKnnmTD28o2a3+glD6s:hHmyxH1Ty+ZKnncDoblD6s

    • Ermac

      An Android banking trojan first seen in July 2021.

    • Ermac2 payload

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks