Analysis

  • max time kernel
    136s
  • max time network
    155s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06-12-2024 22:00

General

  • Target

    4fb51747475530f32cf31ce7f39de9767af66a3877342b034f440463b4d51158.apk

  • Size

    3.9MB

  • MD5

    c1c4c11da3883b7c06a03783a82750a7

  • SHA1

    f8fd5d0e62604b33e813da1eebee8632b17aa269

  • SHA256

    4fb51747475530f32cf31ce7f39de9767af66a3877342b034f440463b4d51158

  • SHA512

    23b4de8b1fdcfa2a6a58b168944ce9fed618e8910fccf4a66fb89cdbca14cfba432b99601a450b66f9f2874806b471e7cab6bbbec217fa2dc6b0145928c1e985

  • SSDEEP

    98304:n8ZO8+p1rQL5zPCO2UFXbzCz+/Gd/JdEqFbh89Q/:w3+pVQZEyXbCeGRwqhhcQ/

Malware Config

Extracted

Family

ermac

C2

http://154.216.19.93

AES_key

Extracted

Family

hook

C2

http://154.216.19.93

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac family
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kahveonay.marka
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4226
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kahveonay.marka/app_orient/wR.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kahveonay.marka/app_orient/oat/x86/wR.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4253

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kahveonay.marka/app_orient/oat/wR.json.cur.prof

    Filesize

    2KB

    MD5

    e710eb12213c9fa9a8cd6b04cde2ff01

    SHA1

    f229f8c84b55225f670e7f54a1826c7a0f70efa9

    SHA256

    4f28d65b65cae2f47b5970b93468b7ade2dfb20bf9de505cecacea610914c2ca

    SHA512

    47598dd7b9cf27ad8a6ae07c780cd186911f4d80beb3be31d7a6cfb4d6debe14cd63d41753be710a28b7b343e1ba1de77c9cb46c206b9036fd4a90335f262c0c

  • /data/data/com.kahveonay.marka/app_orient/wR.json

    Filesize

    736KB

    MD5

    8f5252d74c04ece405cdfea896983624

    SHA1

    64362583c15222ae8bc070e60036b19bfb83ad17

    SHA256

    49c397e9e62361b35447383e5a7ad5fbb638d5f35b0b1533d5b727112314f99d

    SHA512

    34d2a2deb8cd8c4778431c15de003b7fabff45062234609f69b06b4505efc067dc0eb5040d567faac829bc0b2101b8848a46d380b09268baeb5116022aa9dff3

  • /data/data/com.kahveonay.marka/app_orient/wR.json

    Filesize

    736KB

    MD5

    bbe3bcc975ba70472c7922654d8eb480

    SHA1

    fcb503d93adbe0c16b4a4ad04c51413faf84aa77

    SHA256

    68b230c4df3137c663571bd7f86182d6e9e2f4e6b1fc19243cf56fd07d68ce93

    SHA512

    2b382568a3e3eeb35f07a736851e3983232a8beb32090af8f4d2f46310d164dfcd701c6b1a27d2d60913ef4b5f15dcfb7e1b620cf02057ee4881b2caa87de458

  • /data/data/com.kahveonay.marka/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.kahveonay.marka/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    8b1b2ef340767634120018a815e453c7

    SHA1

    f5b96340682b7b115d962dfe6bf9454b36e93b71

    SHA256

    5f39a529b729c7812740a69d868ec2138aad74e640919d9842bbb2b4aa816f8e

    SHA512

    fb58e6856bd32dc219db0cbd5432c0dce9d7daf471395bed2aedcbbbcaa03d26b2396420bb9ca231c6c637c47e2a769670a96ea9f8381f8cfd087ed74d795154

  • /data/data/com.kahveonay.marka/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.kahveonay.marka/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    83e762968703fd7678b25864bb7d1bec

    SHA1

    53e501658dec3580e24ea61f1d2bf18156be3b7c

    SHA256

    d19b39310683327a8c5e1c7c647dc1da963a4486b847316d6f5d25f8e6bff3f9

    SHA512

    51b85b906fbab11513e721d1b56ce592cb3301ede316a91d1019ca8091bc310dea5a3f6b60dfb4b128550edb19d1b94dbc2cee03c32da64e01d9c918a49b7278

  • /data/data/com.kahveonay.marka/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    c1d78b8e687d3dc3a13aa917e5987c3b

    SHA1

    b762ca429bd07a4a4beb564cab9dd6737c98f765

    SHA256

    0c1c25033105f86b93c9f24970c009d7d756ae6972585f393c24ad88167d84a2

    SHA512

    c00c14c386dc6ac9694919d32d01b2a8020b2281a4ac781a0ba884557441d722abbc2732abca5495bee22e0d13f93d195b3cff3bca66a3b77eb80e77644efec9

  • /data/data/com.kahveonay.marka/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    85e8c3ce829c14481a67822644e09f50

    SHA1

    144d6dd34dfe04618f0c643c8b6c4c9583462aa9

    SHA256

    bd205b48819ecfe4c591b086c1a0daefe659713395d7a2dddd7e284800c56e7c

    SHA512

    13af29f631fff0249aa3597e5b00655d0dea30ae471f2fb54fe88f1353362a8aa1671af738c0c7ebd9ee467f73d4e434a17e63c6a99fc0e187db733c92ae78ea

  • /data/user/0/com.kahveonay.marka/app_orient/wR.json

    Filesize

    1.7MB

    MD5

    b1c17cf603459bf3cde6792f1872c25f

    SHA1

    245bccea23df07e47832356ffb6c240eb39f27c5

    SHA256

    54f16fc7e7fa880f6bc4a47d206a1d2d50dad83166f60001e225ed8c8203b533

    SHA512

    5b7d5e7adeed8b48f36afe7c29c0ef03493257eb87e1bb51fc109278d154e5277cf46bc8e13d296ea0fb49375c5e48a82f954a527375827777d9456152b5c455

  • /data/user/0/com.kahveonay.marka/app_orient/wR.json

    Filesize

    1.7MB

    MD5

    c16331a931011722a8a3f4110d016935

    SHA1

    da0ee471f9918f2f4237b2b8c4b312493e7c208c

    SHA256

    0ed058b78dfc76d8250582cf41a2fc98c51ec7c7ad378c820e13d8d8c732b74a

    SHA512

    18d9f1c63a4fce491fe10f4d8c0a735544fd0a6d26585ae7311e2daaebcbd34c8e6694285b7d637213a56a986b3dfc0de3f39986e9eded86b5d4fb47c4fdba5d