Analysis
-
max time kernel
145s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
13-10-2024 22:09
Static task
static1
Behavioral task
behavioral1
Sample
a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e.apk
-
Size
1.8MB
-
MD5
22597c6ac1c89b9b31a1c135b613a645
-
SHA1
2192ad0149233dd8477babcf64bc643a5fca089a
-
SHA256
a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e
-
SHA512
10a5bd408d886d702773aa735a2e17dfb3e398b90f47e9c84224b46b04848c5271d1be49d5b042bdf9a064a1e0187a2efad105ec5ceb48a78fabbc36a4770074
-
SSDEEP
49152:Zg/94Z2SrHmjLKxqobYnc1Th+tompsZKnnmTD28o2a3+glD6s:hHmyxH1Ty+ZKnncDoblD6s
Malware Config
Extracted
ermac
http://154.216.18.158:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_ermac2 -
pid Process 4650 com.makedubefomi.tudaki -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.makedubefomi.tudaki/app_apkprotect_dex/apkprotect-v1.bin 4650 com.makedubefomi.tudaki /data/user/0/com.makedubefomi.tudaki/app_apkprotect_dex/apkprotect-v1.bin 4650 com.makedubefomi.tudaki -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.makedubefomi.tudaki Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.makedubefomi.tudaki Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.makedubefomi.tudaki -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.makedubefomi.tudaki -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.makedubefomi.tudaki -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.makedubefomi.tudaki -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.makedubefomi.tudaki android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.makedubefomi.tudaki android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.makedubefomi.tudaki android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.makedubefomi.tudaki android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.makedubefomi.tudaki -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.makedubefomi.tudaki -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.makedubefomi.tudaki -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.makedubefomi.tudaki -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.makedubefomi.tudaki -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.makedubefomi.tudaki
Processes
-
com.makedubefomi.tudaki1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4650
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5020c2fe46313eba9352761a685aff345
SHA1cc37a8d7021234d734fe35510cc4a939b72e3e88
SHA2564c7df706fcf6a588090fe1478f0af193d9df12f8a2b26cedde656127bd33e5a6
SHA5128498593deb09709b431ea06a3d52d3a2d1aa9c9173f0155d74dd536d64b7900411a026090b7d8d43baef07f26074c684277af9fcb4a62fc55bac73fcaa88a6f9