Analysis
-
max time kernel
147s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
12-11-2024 22:11
General
-
Target
f2d01c45e252f781a56a8ab5b89ebfa4db6c90db8a95202d831d404cc7f2761a.apk
-
Size
3.6MB
-
MD5
e35319056a81b17979da132bd2294a73
-
SHA1
ad6e3270762af7be035f53781dca0819a72906db
-
SHA256
f2d01c45e252f781a56a8ab5b89ebfa4db6c90db8a95202d831d404cc7f2761a
-
SHA512
c10537354ab456afab51021778e1b5202244b625a7e772a4f4f031f84a88e2662288912ba430e74388fd02cf6cea80c2d28ad15df5a724e9994f5b1ba4d021fe
-
SSDEEP
98304:2lQCQGxYYqruDRxww5Thkp4tLXRc4OTe67G0ihOakEUg90o1u5l/ghcfHFy9eJx:2b06Ty4ZdOTe67RihOaZ0+i
Malware Config
Extracted
ermac
http://94.141.120.34
Extracted
hook
http://94.141.120.34
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dehodigipuhixoyi.mafuko1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
MD516c5f0664114551f640c70293e81d20f
SHA1d2383720a44f0fac82ebbcbb33ba45fb9f76a8e8
SHA256a90abed94c83f245e9d9271faa83ebd758e3d2fcde83e864904aba041d7615e5
SHA512f1603be81d59bcfdc3f767c52a0688f3896ee816a7a3fd1a43f887041f8033eafe3ad2272e08b910b7b92810bac089eb99d51da110aea718aad3b5e9d11fa5d3
-
Filesize
736KB
MD5fbe8ea54b22b070e42b446aa11928857
SHA10b687ea5b527e719ca8b1b5fe206602f5ccd2415
SHA256d0309c99dced1a6710c4f6d48fff40744cf193042b673b4b74753b4af7c83f2c
SHA512a8c43cea589f5610e913d4d1335e22c7c05c0a748d9e63403cc0b1d04a22f8aaf739ae12c8dc185508d4385171f5665de9c1f71ee634010caca8ec2da1fb1adb
-
Filesize
3KB
MD52fcfe89a53047d6cbed1cbf60a000bf3
SHA151dea40a3eed66fdb123ad9090896eb5b632e685
SHA256c7912dec70a3c2a707a4e1f528aefbe92659142a2791d464a27334d4b8b486ac
SHA51204346bfdf87559173f9b870e1eb60074f18829f9479b9ec96766ff130ddf8bb54f104b2a69a7894f404e3e1ff3fa57e66e6cc6b209230e23cc3b9e15d9155ebf
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD54e33f5989e6ecbd7130d254b5314d59d
SHA12e7a83631fee351aa9a82bdeb2e72f9f6bf5be81
SHA25624388618525aaa3667e8bbe2f27052a208acb48fd757fa7ca496d8b46ac4130b
SHA512db22e660bad0f85cf6327f42d59b9549bab811a979f15030e4bae57431c8c8ab0b77e173db18e7416795c02cbc853d6ec4da77ea0affa042c6ef3e25287b0f48
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5115522398945c9405f3e6167838497c0
SHA1f4c31045c12352437a45fe50d941c17bb9a9f112
SHA2565a3b1c4a9f76b96d57b3d37977c00e103f13bea4ee6afb9770a93bc115e30e6c
SHA5122de8dc6ded0597b2c45689953f6e406dfcb30e8f45ea60e5953b2c4395b47c7336d9c1543bcb6ba63aa97398a94c04eca64d81c111d926279bbe0e4020771df5
-
Filesize
108KB
MD541444754a826ec05b387c7bc292deca8
SHA151476a87869eb1a08888213ae6460cf1c6b829c1
SHA256748a7025f8cecc051a333bd9655023cbeb3067ad0204cc65965be3effcf5b421
SHA5122399d516a5da5d2b9984ae57a5c0a7a6a459a877d6397a961896de8f82092ed87133e2ecadf5637502e1b389fea9776754115d22a4cdd1a70b022f7c8e243e4a
-
Filesize
173KB
MD57fd6b5ba7a22d6a34446b2b1db251cfa
SHA1a7db641abbaf287feab74c60e989911131a0c690
SHA2566e8bc79d645f7cead87db2c74404233820429018c257259c7f4c69481417e7e0
SHA51271406215dc9ff0ea0050ca4d1222b55cbad2c889898b781c97ff4524d5639c90080acb52b5e92f6786a3ef427bacc880828b0d05d21be507c3527d99ff58de4b
-
Filesize
1.7MB
MD56c7be00ec566ec1886cd742547b59103
SHA1bcfb259ae79f96861a028f30bc36c16ec6eab87e
SHA2561772c8c91758467d657eda8881f04fc377dc6c57a6299388dddb7541190d73d2
SHA512af43e61bbf8a448b301212fbeec237f4405fa3c0cbd0e4fa4084556dc63c1a873b909ac176b5b837f19b5e3ae41a2b62b7c8b0fa188246fcc01ab9f1124568c5