Overview

overview

10

Static

static

6

edbfa361d5...03.apk

android-9-x86

10

edbfa361d5...03.apk

android-10-x64

10

edbfa361d5...03.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    12-11-2024 22:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    edbfa361d5fc7e6bb9181d3344fc842df4c6cb8094fb8223b1967c374de54703.apk

  • Size

    3.7MB

  • MD5

    1f803fed4f81a2c864d54da14fb7da1b

  • SHA1

    d1de6de4c42faa166162b33c0ebe12dbb30bc390

  • SHA256

    edbfa361d5fc7e6bb9181d3344fc842df4c6cb8094fb8223b1967c374de54703

  • SHA512

    e5efcc25b03ae33c0e0abe102919613b19c40718c637b48a7a49e7d76a3ca1454e0d9d2b16d268f766fde3d77176c4e512183f696279d39fb63541e43b3cc6cd

  • SSDEEP

    98304:BPt5E20Lt2fRzNUDZaGDou6S2jZZwYLIf5jOySNgrKDD+lk5:r5v0ImouQjZxyjZdKDam5

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://94.141.120.170

AES_key

Extracted

Family

hook

C2

http://94.141.120.170

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.dehodigipuhixoyi.mafuko
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4275
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dehodigipuhixoyi.mafuko/app_guide/lrI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dehodigipuhixoyi.mafuko/app_guide/oat/x86/lrI.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4301

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dehodigipuhixoyi.mafuko/app_guide/lrI.json
    Filesize

    736KB

    MD5

    8fa5c3d4a00280f934937e488c00ee3f

    SHA1

    67a419056a0e1615bb69fd6078adff33fc8a33a1

    SHA256

    f4fc14889ea5239bf9471c4b99ecacb54a2628ac014cbaa1b40e0cba527d86bf

    SHA512

    89e86b4cb5ee2735005491e3eb1c1d20fcad4a1cd4b9a13849d5108cb9780201f03fc8b7eb4690c337b0161d698cfb60f3bb87eee5af1d6b250d5b226d7f77be

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/app_guide/lrI.json
    Filesize

    736KB

    MD5

    63ccb5d6e1a41cd8ad42935e6fdad575

    SHA1

    e3762ef6f674ac660414ea58898e5011cf8c3e14

    SHA256

    0b23ac8587f5bdba6625b2185909ffa81a7a313cda6da7e73ae6ea530fc25b78

    SHA512

    2b17933b27b0ee09bbe5504c869009effe2842f81e47c5ab8aa5048d49761396155ddabcec45b61aab1a36d51580f29ba007fbe87576511c40691ddc3d88f42b

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/app_guide/oat/lrI.json.cur.prof
    Filesize

    2KB

    MD5

    49cf73ff2275674fa8eb47c4b17fc768

    SHA1

    d32eb5554fe69608e9e4646cceb2bdfde3f580b2

    SHA256

    f346b2fbaf820d22982e16507a065f31a429e35656ca4a8d7abad9afa0740be6

    SHA512

    71d7e4334925d73fd1d8f27fc8804d7771dc12223b687ffa4676f8953dcce687171597f4531d21f1ca94c89609b4ef241d729cf2b20de9aba46388db697d8274

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    14b4bc490f363047652b28092a6a00da

    SHA1

    ab5b0111e8082ea1b5b659d25bc650889b184044

    SHA256

    d90c3f4b623f2608e480c06d5ac49f2f95085fb1104b78a1a5f34186046b52ab

    SHA512

    0f0a551d4935fd3a4cca51002411274b51b424a7df35bdb85b94283962b092c71a18adea4f0a860a006d2c2f89952b4b7fee1f738b194a6b23f9508d65cad276

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    a6be7ba74b4db0381939f76c2edb0e47

    SHA1

    6cacdcdcaad5fb9b8f10bee8276cf6d158f653c8

    SHA256

    9ee67ff578f3487b806d191d7aac995c2ea0d94cf2117a53b8560bd82c06631d

    SHA512

    6e38aeae87a668818d7888270966f1f88d1369efa2b7424ee3265fe8bd82af87185c344e1a078c3139205730c9ff539f406c3db4e24c02fc3da079059ff44153

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    c30a7f0846f508759750ad9235ec2796

    SHA1

    876776cb033049decf2a2d307d9f5100d4ce9ca8

    SHA256

    987e703043ee5b3d089a3f07b7db35b202bc91933581cbe02b3b205af8a3c464

    SHA512

    9c3016cc4ca12f2b7716aef44d7c1e274119b66ab0a170e2dba6b1e305b12e0689baf43ee69997a0846b258b5b97ade089f3365c41c8464d78efb2f616694395

    Download Submit

  • /data/data/com.dehodigipuhixoyi.mafuko/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    66a542ee26761a0e993195669e777244

    SHA1

    5aa682867e54da5e3ff98ccbc7218bfd09b4a250

    SHA256

    f620e167f0338b5b2bce131d3c341f21b11df07adfcaf4e1b1cf367a97cbecca

    SHA512

    889ca82fe0ea79f7c1709a3bc2962bf2ab32f95ddaf0457eb1942d9d27a17e2d62a6f28cfc200207f8143271e100fc2b6bb09bca7d195eedc6df3aa543d4197f

    Download Submit

  • /data/user/0/com.dehodigipuhixoyi.mafuko/app_guide/lrI.json
    Filesize

    1.7MB

    MD5

    38976f2c8ef1197b7dbc194c01e4c3aa

    SHA1

    a0df5ac1072982c9ebc6332bc9baac58cc0c7a2f

    SHA256

    3adb847856d1b46eaf04ea7779bfc3f64cb6836869c38e8531a111f9a1dbfa01

    SHA512

    12e973b2ed3dad598c4bcc1c485caf510b2f30c347b0e413147dfb95a12d022122929f30619673f23cd1b8ed140853eca5427958866c5548655dd784e2fa9c78

    Download Submit

  • /data/user/0/com.dehodigipuhixoyi.mafuko/app_guide/lrI.json
    Filesize

    1.7MB

    MD5

    4cb3ac5f63257c4aaf3d2e14e7b274e8

    SHA1

    3711bb1950c9e683f79fce10ce46f3d849e6d4bf

    SHA256

    120c9a3d9438467b0d14c9d43c12215a434fed09b5ac4d0ac3afb20851f4758c

    SHA512

    ed73e5b74b4d81b35783d45f630bcaf53008568bc8a44723e6f06f30ea643d45970d5bb3a9b7231677baee3421aa42b7975d3a79fd15d3e1d039221a76d481c0

    Download Submit