Analysis
-
max time kernel
148s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05-12-2024 22:08
General
-
Target
7286a2830d2214fac25d5f62c28b70897d842b1e5fad9214b02ba70bb35dc846.apk
-
Size
2.4MB
-
MD5
863ba7fec806154036e45f25241d1d43
-
SHA1
b5c4bcfa3bbfc8301ccdf9b709a812d5eb65556a
-
SHA256
7286a2830d2214fac25d5f62c28b70897d842b1e5fad9214b02ba70bb35dc846
-
SHA512
6096b2a54e44a523eca2860c7b41076bc443a7d1c45ddbd542aa5308063d38837765a77301310cad89a4bf64b7c6c2bfd3e718e967c89262236f0a1e161e8dea
-
SSDEEP
49152:nvVzIbdQ7/lPCWvGnpiSWp2T+KtKHXrgxGRlKNLYT7SxVny1T:nvG+ZCTJokPNLYTeVaT
Malware Config
Extracted
ermac
http://154.216.19.93
Extracted
hook
http://154.216.19.93
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 22 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kamatkap.mafuko1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
MD580aca0a5925e60b7ae640a47322be0de
SHA1c0e493bba4684dde890cf0801bbf3c1544c1d34e
SHA256e679b180bb14f187c3a955a3a9626c6429515adfe6ff08a12930db14afa8a260
SHA51280fcf84986771cb5f69ed3f981013f290f21ea00150e711584c8c63824e5a6a15c7bbf5d93df3bace554a03b565dec3215c67292ae8b44b95622eed8b013bc3d
-
Filesize
736KB
MD5ceb7bd4672788438a60c0bbb0dff6bee
SHA12a37ada1329d76e0644583a8d396e284448ac2b0
SHA2561383bead73528af91c1887ec294411b4c6958ccde6f38fa98dec348a4dc0af91
SHA512714dc50a2c363fb17f2f8c799e7fd2f1d2b0647d91bf6d9f4893d7933558d7b79ca7bc2415f2a4a0b1302b9c7d2762a2c62ac37329bf7d06efcbc7736d1013c0
-
Filesize
3KB
MD556550e71603c23e10a330e3bae05d920
SHA12f4fd44cb18e05ab9f5dde92e6688ba0d79e087f
SHA2565e584a73aa2f1962155ddda6218040acd676bbfffbd69f0702e22354d05c70dd
SHA512319cd97559f77baab1dd0bc093f21223c6f1c0a6c471162fe6cdf24d4ac1245898fd3c6a1423797ec646b56cc08a0ccfd476b4a1b5409cb227317f95330dc7f8
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD51956d952b91a19d002865518da97f6b8
SHA1b5a41e4e42171a072d94417fc347384767e7e56c
SHA2560c644b503235359fefab9bb2cda7ee309cdb90d27e0fde959798d6566254dac8
SHA51212bc2d3881d8c8c052f4d24a55ea44864a4b5a9a2f97ea4f15b3aca8c20e29c9383d22d473ab128957c1e5d5b0a45ca2da6692f398543a12cf4d8f4c90c04c45
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5bcf401b80ca1b5d259d0bfdb0587c48b
SHA19c191d932cc7f7eb3e5b1d20ad0f87075ac3369b
SHA256070812d495027fe81c6626559727dbc747dadee4d45eb818e69b385941ea76fa
SHA512cce665f7d20e1c8c9ceb7b2f469b33c70e07b15195b98664fd89d7735ff448673a35535a1ae18c709aa36a435c91467a161003835ffe4e58f2cb937c69260347
-
Filesize
108KB
MD529c9c288dfb566666ca117733adad5fb
SHA1777ef22021de17aeb3265a92e0b10c6174c3f62f
SHA2563e64e5fb6f32e244d29b859de10e6bf84394c158bb273bf3d1bd306a9f53f9c2
SHA512681692dc6e89184548ca087dfec066bdbec1e159e13e85ca695ad98701daf73bdc3bdcef25c2b8bc2f540a5cd98e4dfbcf35afa8a883a238264e6a229a4143cb
-
Filesize
173KB
MD5228b35362b45db471298cc8d74843282
SHA1836cac7f38dad267c03d6a699d64580b3f027a57
SHA25651ab5a7fafbc8c3e60f594c1bea2b2a6ae73656325c41719718ccb9f77d4e0bc
SHA512b391593aa2ef2c97c31a769a730be9eb9ca4f6811249f72be72c5561f4a1f373ecac9e5058e72dbbe33496308ccf473117ecbfaab379b5d7a922284722cfb70c
-
Filesize
1.7MB
MD5332e75f1e51240a01d136055c2a31788
SHA16d577e35bb5162bd93c3280827915a81da441838
SHA2568429ac18967aa2f7aac10d6d3ee6354203b7d5104acc5ca7f62f33e5a81df17b
SHA5129f1037a551228f382aa5545f80a8c34e99f6b3c5b434a39474eff301c675885b1be9698a6b740ed9664b65ffe45b34d7d32a7ad06c39537fa2cdf292195d8d30