Analysis
-
max time kernel
146s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
06-12-2024 22:06
General
-
Target
c799b8b74b01e724c10f41283fe4cd23008a687feaca4b10c37f37d1b47333ff.apk
-
Size
2.9MB
-
MD5
adfe76f6376975d2cbdb462afe30e485
-
SHA1
db9d59c612283b8e6f7bc671947d5938e6fd8dc8
-
SHA256
c799b8b74b01e724c10f41283fe4cd23008a687feaca4b10c37f37d1b47333ff
-
SHA512
cd2e641732901cf9fa0875bdf07d215e8a4b6dfe2eaea3ffdaf4e9b9433d69f6bda3cdb7c7c160a69a733f5280f2bcdc0cfa6302345112f48490e8bb50583797
-
SSDEEP
49152:dOS+lWZcMyxSCE675P3rgcR/LAIw7o1Ysh+V1x7GgD+ikPIKwQwt3mhvYL/7:HGMc86JXUIwQXho6PIxFtT/7
Malware Config
Extracted
ermac
http://154.216.19.93
Extracted
hook
http://154.216.19.93
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kahveonay.marka1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c86e8a39c6d88a1c502f048392e47ed1
SHA195dc9cfb41597ee87094564ebca164a8cbb18ab8
SHA2563e815824c2e1a650fe3880a1105c4075f42629dc68f1c289a8a74d44ca8b4ed7
SHA5120ed704ad43e18f2ad0f00b7e813e350de073c1fca50d0e916bac02883c951a6ad5b37642589b1fc9da91e7d9075a5da2fc380500dafb117a0ff1e33ddd62d368
-
Filesize
3KB
MD59bc2a507234c0f8e6199016892a71e55
SHA14eed71174342da93c3f5841f660f94ead9816c76
SHA25665d7f1323d32e78b0c295aa85fa5b59a4d89a3acca5b63fa869258b126f4dc07
SHA5122da2d0e38ec5af4515ab6ca02a5298f3aee981bd8a143cf8e797319ed4756186100d84ea489f292cddb55082b1010634477556166616a98eed0ae769f62aee69
-
Filesize
736KB
MD530deacf0f95af9b4e6051b414ecb89f6
SHA115b04a0aad2ef21cfbfb4bd0889a6bbf0b912312
SHA256d788f9929b0ca46460c10d333caa86c50d77de7522dec8f94db5d7de1196f6e3
SHA5120958e2f4b6b6a759c41ba5954aaf90679dfa361b896bccbf5cf96bd1d47ecfb99cc4fab0f9d7802da0cc47c9fd2a672c314251695bf652b85eca3a9d046a8916
-
Filesize
736KB
MD590ea349ce641c68207417f96e291479f
SHA1928ee2fe210622d751b020039a3964ef749498b3
SHA25668b835bb19e7299388c1bb327c265b514f5c9552738afb3c3a899f1b33eba512
SHA512e4c8a6fb58e0cc08023d8dcd6d0ca3d4818c7170019f8afbb07f8b6df5abfa202e301f7661ba163e036d8698c36c537326b7d9ccb49262c13fa48640565365a5
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51c62d2a781178e0ef486a2950f66601f
SHA15d6a00b1213bf2227ad07b11f8413cf1ddd04ddc
SHA256a04812a43476f2928f4fadc1ec9da081f7c92965018d8b73f4cc3ef342a258d7
SHA51285e6b28b0d6bc7ddcc8d6e758e3c63ba3d1b296c287c4d833359a6b170e5f77dcef63f9452719e128b482ca0888e39246f2d019fb945939701d684cf3e3cb9ff
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD544bad1b384b836f11350d09d558a59ce
SHA1ace0d366af9369df8363af4faf20bf41528f1f39
SHA2567bd98798d7dd69e908f2456cf4d13b378fd54a3b17422501602e756ac91eb0e1
SHA51264a40d02ea9e632045e9b593dffea5b8847fb2b4ba6f8bc0a57871294637fb36641a236581126d75fcafbed6eec2fb88f6e8fff51e7007c03cad953d1a4bb088
-
Filesize
173KB
MD5793c4ff8ec9fb324affa993ed4f11bfb
SHA1b3b3a0e7ccb513d3068e221a47f43d6f1a218ae4
SHA25622d5b8411e27f0d42a46974d6f44d2d7f8b963eeaa175b61b4a49654d34c0562
SHA512c0716225425cf1b5ab629ff1c5e283301645badf7d2f870174c0bce6d64627a22530c4f767711759a5a3be32e2d2c08f7ece37d9f886553dcffaca89c65c65e0
-
Filesize
16KB
MD5fdb51590f6d29a1bb4f6397ad3285b35
SHA1ca511952f5096f5414f22c18b271f90dff7424e1
SHA256391d111da2f3ce8cb48ef2499a3b09fe4641f846b4d1329ae2655825f0cd2a76
SHA5123764f9a4888f9819b20e1cb6b0cb66af92c772da836aa75dd094a4a0e04a628b3dcf74ca212720c47b92ad9d04ecb55cb086fa643d6090f84e6d3097cec95599
-
Filesize
1.7MB
MD5c16331a931011722a8a3f4110d016935
SHA1da0ee471f9918f2f4237b2b8c4b312493e7c208c
SHA2560ed058b78dfc76d8250582cf41a2fc98c51ec7c7ad378c820e13d8d8c732b74a
SHA51218d9f1c63a4fce491fe10f4d8c0a735544fd0a6d26585ae7311e2daaebcbd34c8e6694285b7d637213a56a986b3dfc0de3f39986e9eded86b5d4fb47c4fdba5d