Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    20-10-2024 22:12

General

  • Target

    c37196d4675cf0740828d2ff35803222f545918fcce9067bf513518d7822b557.apk

  • Size

    2.9MB

  • MD5

    1ddf4a7348f0d3a70aec759c57de1248

  • SHA1

    281673404c7ae7526a355feaca354458fc7f3b07

  • SHA256

    c37196d4675cf0740828d2ff35803222f545918fcce9067bf513518d7822b557

  • SHA512

    2fbd4e49c8bddd0a643e7fef45cb8a2434506374315d651c6e19cf9aabcfedfcfbf29afe958ec1fc776ee499b2502ed5230592542da14153e23578dbc73b8d3d

  • SSDEEP

    49152:U++++lXPmZbVeAMTY2fvdAFXuH+ht9Yg8DjngKYTya1JCFHnrNUlO0tHUncfOOX7:U++++lX+5kXfv+F++t9AjnITyiCnrylz

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac2 payload 1 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yiyukeyahixu.tuji
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5239

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yiyukeyahixu.tuji/app_DynamicOptDex/jnMlIJI.json

    Filesize

    674KB

    MD5

    75b09d6b73cef56004ff89c7cbb58b43

    SHA1

    e6fbed764b1b829441b62e3e6780de626c119be8

    SHA256

    ea64714411b400aa469fa3d06e1efc6cf1e50bd8bac25e6825af34fa8a767271

    SHA512

    0ea2233e911925438e06a27681ee1e1abb8e2eef20f4563084f7ed0fa0e498f8b2c402d773a2012fc21f5782fd1ce21b87db046a2062b0aea066f19eb20130d1

  • /data/data/com.yiyukeyahixu.tuji/app_DynamicOptDex/jnMlIJI.json

    Filesize

    674KB

    MD5

    c48b7cb8f1d224aa08c665dcb0255991

    SHA1

    5579a6c0eaf97b6cd5b85979ee44d256a9a7694c

    SHA256

    7f2c04b0a2b990475a2c0a52a2c6a25794637dea72b0497ad749d227d25d0101

    SHA512

    f360625ce199943654cd906cc2144963837f4a5ba89bc212afb861f6215e3ee913e72ce09c4540aa7846d9eb4732f1f864eb776eb71a036a71766cfe1413d1a5

  • /data/data/com.yiyukeyahixu.tuji/app_DynamicOptDex/oat/jnMlIJI.json.cur.prof

    Filesize

    3KB

    MD5

    82e7e9a6c97a55aa6b5f8b733e87944f

    SHA1

    5b6cc21da41467cae9e85385e839044f5e386849

    SHA256

    e9c14bc89e2bdf65b817c24646167aea6ed2d083c6bfef302e41ac22ecfba427

    SHA512

    a76c6124d6843cd6a3cd168e21eeeacccd7b5399909ff4e743da42a985f4c75b60d6ecd0de35fbf3286a1dfa599ff029b1643e30651575f6874438d7e4ff58ba

  • /data/data/com.yiyukeyahixu.tuji/app_DynamicOptDex/oat/jnMlIJI.json.cur.prof

    Filesize

    3KB

    MD5

    d2b667c1ce25ddb139a40cd9b5c00f2b

    SHA1

    ce0faf0713607ef17f7c638f3f34e12223b0921e

    SHA256

    b02d4fd53e4d64dd4fc3350eb8336669f6c0367eb5740746ae5ff01883ef5513

    SHA512

    deaef7c856bd31bf13a35f04bbf64048ab6914bfa018b0565c1a5fdd9551f339bb95e76182a2c54c20e31a551c7e14e1f5dea2c56d333201a0e7e7ed163a72b1

  • /data/data/com.yiyukeyahixu.tuji/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.yiyukeyahixu.tuji/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    2a5b65d2b59e3c232d85e1cb164420f8

    SHA1

    d870696bd4c0957d4d754c7bd0ffb026f47609ee

    SHA256

    de51bb1d1308da24d5572a5f8d7e9206d77815ea0705917299b57dcc5edf285c

    SHA512

    b02f47b9bedce1d0b6866c32a9cf1b685ac07faecbfcd67a34941392c91f98c184ca392ac12b1305ed46bde0360be39a0cbdde8d7295fda67ea30a30c15ff0a7

  • /data/data/com.yiyukeyahixu.tuji/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.yiyukeyahixu.tuji/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    6339b71b9a69c9c66a58795195930284

    SHA1

    2c344abc20ae1b049195939489b2df6a964d6e51

    SHA256

    ebb9c428e50ebd664475a35481fda40ba5340abc4aa21d797d708ce3df23eddf

    SHA512

    be5d2b4ff9d45192d282395afb6c5cf789a95f7a3158fdf158d4cb6e47422745a1cda91d1bfd7cd59abe70134c8db8f9c5d756ac6cad9b8070ff3be135acef56

  • /data/data/com.yiyukeyahixu.tuji/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    10a322ab1cb1b07eab1334785b3b5f6b

    SHA1

    8a008d0363b181b584ace94bb06a51d13a0f25c6

    SHA256

    fd71e3f0774d7b61075723a2e0bc4d4811129e852d041bf5a3afb6ec80088056

    SHA512

    59cb17f5c7055cb5e88f679b8da006ba447c00172388065bc8301b1a481dd9eb68688e330bdec352b92eda3138e5e4c3ab0817194ec7083b18e33a137674c218

  • /data/data/com.yiyukeyahixu.tuji/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    a4545ca4ac92b4d8a371784167cb8d3d

    SHA1

    bd74a2d2b44226d15d534cc761eecc751f4f99a5

    SHA256

    650391de6296a0abbfd5dad01d94db27a0d18f6abf7294dd3a95e3a90d510c72

    SHA512

    76401cd33a1b9b37cb15266b65b7ee6f497ec922b8d2d2062153d89a99f504f3b5bfb866be863a527a30a273da5d72fa8dfe87e291a4515342316e32be93add1

  • /data/user/0/com.yiyukeyahixu.tuji/app_DynamicOptDex/jnMlIJI.json

    Filesize

    1.5MB

    MD5

    fd71ac57aea1d7640599fe2a7dc1e18e

    SHA1

    c7e802dea51a0e8526d79d431ea87d348bec65fa

    SHA256

    0292cc94a29562b337629fb0c9428fc3e49d21105b2d8f2df77c8d45f8ce8808

    SHA512

    ecaa7050cd81973eda6120b9a8e535139dc417acac4f083e960050734bde2e195e61b25b38187ff7be0b09876d2063df26ed5010a457334360333e71126d0ab6