Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
05-12-2024 22:09
General
-
Target
ba0286b818b667b3ad8105039d217fc1036f05b32cc7662a11a7912a64ae2390.apk
-
Size
3.9MB
-
MD5
ff7e436aef33edaed3500bf7425a89fe
-
SHA1
00dca43f1db3af5f0c44403c78a31640faddc658
-
SHA256
ba0286b818b667b3ad8105039d217fc1036f05b32cc7662a11a7912a64ae2390
-
SHA512
4dfcf2492d6a733fc6f06405ee86288c9789643312e3bb6a891bc417643de2ca547176cbe473f0b21494a93e21b2ce9a7f2655c44d6661b3b46c8c65e2967c5b
-
SSDEEP
98304:M9pTm3K1U8s6U+IDoYAKPWM2KtiayUgSubL5dceuWvvrel7cCoCnuCv:6Jm3QUmUDrAWooibnu+ve7noCuCv
Malware Config
Extracted
ermac
http://92.255.57.103
Extracted
hook
http://92.255.57.103
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kamatkblackap.mafukor1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51c6d1858f012b772eef1eeeddde79fab
SHA14e8e8edbbe9760911c3b545cb43c8cd86471c903
SHA256bf359624a2c063dfefaeaecbf4361161ce3d3a2f9400143932817c79d849dc73
SHA512b77324f71ce9fde86b41d63f51006e0d926d908affa844fd2c568df9655f46e1381d4433728722062e01e3c5585f0046278d24eb34c75c9ca73c7778abfeaa32
-
Filesize
735KB
MD58d7fbd387d2e296efca71e4aba750382
SHA105bb7c710a88465951842bc76afbace0ce4876f5
SHA2563de67bf90437b3f8ed178089618f3f185eef83df5e6594047716a698f5c9289b
SHA51279dfd14f0529f6d88d76e46433e9f3f30caea3c9cb3022ebf84ae6b503a0c264c7a04344726857dba2dbf5418191483ad932fc755b6e9edddfd8b6fe9d949ccf
-
Filesize
735KB
MD5b936224c20de2864bfaf454b5a058bda
SHA15f5338d123d08b1e4ce3d7d1e67fcb25e02e3fd1
SHA256a312b2faa3f276d14013da2a16694670854e6fab4361ed7506f78d7e1d109ab5
SHA512df16bcec70a15e2fa6388a54fb1d3a60d47a27d496cedb0016ad0054d981e059a489274b01192474b2dc427b171ac1406df225403ce93e9d7a2838fc6920d095
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51f2a4cbfdb7e4e0330ce4a7626f29c14
SHA1662b2e9c74a9d50b88ce86db907756c9a228a990
SHA2560a8a1319a54580d1ffa0ba4566fbb336a32b0e6dbf240954e0a922cff195e0d9
SHA5124d76895fbee7f8f88c6898efa6bd3b566c8778a043ed732b51d3223124883d97dcc0c474121e4fc093b554e49f0803fe9e83653c090cbdd5a322761769729bdf
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5e8c1f984358c1bafa5ad0332a1a9ded2
SHA19ff16cc3dd1b3b18c2ce8f59f46c0a53eefc7bbf
SHA256efadb66428716e160b5b4a35c35e7e5ec2adceef46b35ea0ed36d58bbeabece1
SHA5121126daf2779f91e7110a9ff10513e27d684e111f2d2646ddb0ffa9a71e2e6b49a1f5d8952d3007c6a729b8b43c25f0cd2633ea2481dc410240f156e551007946
-
Filesize
108KB
MD5d847e84f136bbe48f077462f54944d8b
SHA10b09ca65a52a9d5824e07fd49061f5d8e764dc0f
SHA25657f6861612eb54841843f561206587feaddc2caea266f4655cacb124955b635a
SHA512f84e7a00be6dcfd4c0f932a37c231997608b52eb8874c6227894cf6ebc9f32ccea5419454049a08108cc137d36309b61b068e537aef876daa85ee05c32649051
-
Filesize
173KB
MD5e42ce57d38660cf0f69d76569dadfdde
SHA11288666d073a5799d60037bcb1b6a0111872fb73
SHA256594d9f88bf47893eb0dabdfea1bebb9fe33193d495f4a0d3256a2d2f4803ac37
SHA512240226a423708522e46505db85e7187139391f1b326e3eefea5e9a80c87ff92396d0593f88599ebd9dcb1f9679cce4f667e104d93357ca803904e88a878b2d1f
-
Filesize
1.7MB
MD57c7c24d5eb379144c6db9085c22b22dc
SHA1314cf153034d81c34a98a6ce4d025ce5330de589
SHA2566ad365d15f52445fb352cadee56f71307c358ec2b1181a8d1deb7b3e46c22256
SHA5120e569f141b621348939bcaf4f4f4843269e7a7a9d8a50a6cc87a05cf770b956e2dbda939376c6d1165cbf90342f6a8d9cd4004afb62e67c380444890332cbd05