Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
05-12-2024 22:09
General
-
Target
ba0286b818b667b3ad8105039d217fc1036f05b32cc7662a11a7912a64ae2390.apk
-
Size
3.9MB
-
MD5
ff7e436aef33edaed3500bf7425a89fe
-
SHA1
00dca43f1db3af5f0c44403c78a31640faddc658
-
SHA256
ba0286b818b667b3ad8105039d217fc1036f05b32cc7662a11a7912a64ae2390
-
SHA512
4dfcf2492d6a733fc6f06405ee86288c9789643312e3bb6a891bc417643de2ca547176cbe473f0b21494a93e21b2ce9a7f2655c44d6661b3b46c8c65e2967c5b
-
SSDEEP
98304:M9pTm3K1U8s6U+IDoYAKPWM2KtiayUgSubL5dceuWvvrel7cCoCnuCv:6Jm3QUmUDrAWooibnu+ve7noCuCv
Malware Config
Extracted
ermac
http://92.255.57.103
Extracted
hook
http://92.255.57.103
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kamatkblackap.mafukor1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD533a8d323d214300a25906b99a0595e7f
SHA1d89a9f1a04da37fb81a0341238e65a8a73ebd3b5
SHA256e21a9474fc11591a11cef5ff9dd1e932669e97b1f74cf5b32f07d2d257c7ae18
SHA5123df378e081348ea9bfccbb2efabb4963c9b35e4c05b9358815f041fe2fe444e116c033c85f558b6c637bc0894279c128fcf948609c7cbd0a2ea0022bc2b4cfab
-
Filesize
735KB
MD58d7fbd387d2e296efca71e4aba750382
SHA105bb7c710a88465951842bc76afbace0ce4876f5
SHA2563de67bf90437b3f8ed178089618f3f185eef83df5e6594047716a698f5c9289b
SHA51279dfd14f0529f6d88d76e46433e9f3f30caea3c9cb3022ebf84ae6b503a0c264c7a04344726857dba2dbf5418191483ad932fc755b6e9edddfd8b6fe9d949ccf
-
Filesize
735KB
MD5b936224c20de2864bfaf454b5a058bda
SHA15f5338d123d08b1e4ce3d7d1e67fcb25e02e3fd1
SHA256a312b2faa3f276d14013da2a16694670854e6fab4361ed7506f78d7e1d109ab5
SHA512df16bcec70a15e2fa6388a54fb1d3a60d47a27d496cedb0016ad0054d981e059a489274b01192474b2dc427b171ac1406df225403ce93e9d7a2838fc6920d095
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD53903a268745831a63ffa6aeb55173b60
SHA1f6c060fec43660989e720bf041f067857828c13b
SHA25610472efd50f1cbbf98f6bc04516b680bd38e047fa32335d4fd41ac90ed3762cd
SHA5123234495fdd25657a3eb5a01cd49e923cd9ea0408d982810fc054c0f7a8a5f44fcc95cf7df2130e638fa1e1a257bb501a4e2e2b858599be6dbf1e2d32c5618173
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5f0a3f5e41757000afb5b45f716059d90
SHA167e1bc902ac6e7a71ba54ee32616de0fd633ad3b
SHA25677949f53e938176c8b79d700bd7cda40b78783a9d58e321a64fffe16bcabbdc2
SHA5122e2d80da7efcc100a22e853cecbc696dea3be29793ce9b7c072698698c7ea6934faab7df6d0a10e39c23528761bfe5a66ce4960d7d1018e1ebff287efdd2e5ff
-
Filesize
108KB
MD5fc79db7698f69d5017421bfe7985c35f
SHA1692b92a5ec01188f8b2aff0eb8cf9f34f8846662
SHA25636573acc31e54ceef119eafd685b5738222dfb54a97dc5e46fa9a4f7ff36215c
SHA512edf7780744f3e94b46b4fc255d1ce96d0a43b17f23bc09e4fd8fe189edff691b979ee65595da2636f7eba67ec90dbf07e91906f2fdbd896cd6d91757a2c26105
-
Filesize
173KB
MD5e6f73278cb91faed55558615236f4416
SHA14a82c989197b5799218fae976cb40eaa2feeab8d
SHA2565e887375d33d3788b830989c6ae2ad06bd01f9fa109b6875cbb27fd4b96ac157
SHA51245a4dd982bfaa9f8c7d043b98425bed833be49a8e7ca9d885fe3d6791bf755a131a007484157935d4f7b1b931102579ef0053cccc7ed8bdab91a24a52a0c19c7
-
Filesize
1.7MB
MD57c7c24d5eb379144c6db9085c22b22dc
SHA1314cf153034d81c34a98a6ce4d025ce5330de589
SHA2566ad365d15f52445fb352cadee56f71307c358ec2b1181a8d1deb7b3e46c22256
SHA5120e569f141b621348939bcaf4f4f4843269e7a7a9d8a50a6cc87a05cf770b956e2dbda939376c6d1165cbf90342f6a8d9cd4004afb62e67c380444890332cbd05