Analysis
-
max time kernel
149s -
max time network
153s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
14-11-2024 22:11
General
-
Target
239e662b900dee78d6d7c9cb96b7228d6902b239dcd7e7fc53b6123fe119d524.apk
-
Size
4.2MB
-
MD5
881dae2cfaf07f517d387d2efc4374f1
-
SHA1
8805a4f0be7f3b8f7c1d65255dae4414cf9098f2
-
SHA256
239e662b900dee78d6d7c9cb96b7228d6902b239dcd7e7fc53b6123fe119d524
-
SHA512
995d589e281dac65473fe76552485f937f9158b94269695093910b73ab65f29b11bf755a3010b359da963c1e0bb4f7c482c9430c94bbc23fb062733041cd6f69
-
SSDEEP
98304:XQEEAQu4Sb2yubA4iLZzwUCpVNj8lnUZliI1gqi4YaDVeCz7U0Gqi45:XDZxCpMlnuIlzapeC80Gs5
Malware Config
Extracted
ermac
http://154.216.20.101
Extracted
hook
http://154.216.20.101
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.dehodigipuhixoyi.mafuko1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD54e8f8b5f30a1f5096e0ba19d1395dab1
SHA1bbfe92e6bc71631b486f55daf11e884bf6374357
SHA256a5f73277cefc9ee16f96c71a2bfe75a21c903825441a86abd33b3e30d33aa54c
SHA5120cfcb02b7257001ac0d00d62d64a0089578a6041cf14bea7168b24c2d84c44f7491097acb28c94cc5cc62dadedb496c27e31fc64b16f0f917b04c4dfc6ca558b
-
Filesize
735KB
MD5d8340d115d33961cc2138559ba75acf4
SHA1a18748d7f51d3467632433bf42a3fd2f77eff4a4
SHA256c737e3746509207a261a0bcefa153299337da87b24ed73b2b2190087a5bea99f
SHA51269cf94af0169638624f21c16ff5a6b9e96523668f69cac64961e81cd88fcb309895af811016bd9af737ec2f96c2fcb9e3f10a96ddb2a0958571d3bb94749ef7a
-
Filesize
3KB
MD5c5665673f5509bec48f6a2ca5f421cf5
SHA10cd9f46ef23e25fa109e20f9d5c1b0ac03e0b682
SHA256a6eeba33887274c9638ebcd64a1052152855a3aaead57064644e8f501bccf6b0
SHA512806238624cf6c5895cc85f4fcbb30f0bb4ff46634ae8b0d8f42b7a58b552988b2490fd89fe14d5449849ea34e0293017ef20e63de42382ec137a0bfdd3a54583
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD54c8ec4c79edff6700887e399adf39da1
SHA12890008d120ef8f9e0b64fb08e3c2d61f5497bf5
SHA256e14c3ffb3965dd430fc37cc5acf7b6a752c395f717d8ce58c464dc8991a3e49a
SHA51281725ec0bcd2f6636c723c7b753c5a920437f9a0855d2c9d9b47b25498356fb7cc8bd913f164230033cd7f5c02db36cfd398b60cd826c53d19e3ae641c4082c7
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5055e504db75926d8ca9bdab5fe6d3ed2
SHA17987c5cc254e484523b507ac5bf755ea96213afb
SHA256fc3927fb27041b4a350db3d0da71244c3256de6bae1f593e4b448539f6f49aab
SHA51271fe8103dbfbb8eed45d9557fd3f3552b0c45c6cec72e3e6fe89c52d82d0b2aefaa29082bf89030b2a9480c1d7127c2dfd745a7e109290f8bbcc7261254df2d1
-
Filesize
108KB
MD5ae06064c23d0869e683e4eb8e5f55e2b
SHA16d37f346367192b85a82234d0399e72032199c30
SHA2565d8980ac94949c1b0d3b21f7c79ef4a06357337bd75ee84a8f434b0dee40b9e7
SHA512446f8a75c82a128d66216843627543e4424956a041e53c388741ca0630d7531f852fb63129d832c19b8068ae1e8ee10f476aafa2e1f8b948a8c2af4a767ba560
-
Filesize
173KB
MD5131b951b4a89d9d5de165ad77c5dad2c
SHA1396835e516832d406da68496fb81b23526ce37cd
SHA256e75e604b143cfe28f652e21276a3fcb3822d22e928a884361b9a9fa6d3e65597
SHA512ce51c5885a69275b7b31545ab137a451aa7010e6772944642e31b206be5b11e556ca28c6f263d84f5beeef7e81039b0ea00a0282d271d63b3778afa1e798ad9d
-
Filesize
1.7MB
MD5dfa78d2e6c4710c1d9c4ab8a19adc6b5
SHA1741f84e444689cc2abbe6af2d1088378f36a0019
SHA256d227f02bbbc8d4b36ac27c414288df4cecf8370420eeb8d266ee42e86f35db00
SHA5127f0658a1d6c6a6d9e006807f320debce8b54c26be4012dc18477f2fce70bb346cd7b07770a75c29ef2482e22cd2fe670b8fa81957392651d6aaf884ec8cd3af5