Analysis
-
max time kernel
147s -
max time network
150s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
09-12-2024 22:13
Static task
static1
Behavioral task
behavioral1
Sample
80f29e78847d2b9d5dca2667884694147253bb52e609155ae668ef153fa711eb.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
80f29e78847d2b9d5dca2667884694147253bb52e609155ae668ef153fa711eb.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
80f29e78847d2b9d5dca2667884694147253bb52e609155ae668ef153fa711eb.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
80f29e78847d2b9d5dca2667884694147253bb52e609155ae668ef153fa711eb.apk
-
Size
961KB
-
MD5
cdfddd96ec4dbecb6913422a3fca3e9d
-
SHA1
21d318fd2e242712135fe283bd5344c36fcdfa68
-
SHA256
80f29e78847d2b9d5dca2667884694147253bb52e609155ae668ef153fa711eb
-
SHA512
107079d339ca7f65f513746d36ba375ef9be93ffbe53a01dc0c896e36c43a66e437bcb378a58781c79cdc309d17502af9501f69765b92a318941ad6cd9b44d67
-
SSDEEP
24576:9gSLlUELdYh2YlGIeCrGTf4jN1yR5xiho3qtaJyL3:9gS4GTwjN1eVqtGyL3
Malware Config
Extracted
ermac
http://ahmet10.duckdns.org:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 2 IoCs
resource yara_rule behavioral1/files/fstream-1.dat family_ermac2 behavioral1/memory/4370-1.dex family_ermac2 -
pid Process 4370 Com.build.bekemal.apk -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/classes-v1.bin 4370 Com.build.bekemal.apk /data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/classes-v1.bin 4444 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/classes-v1.bin 4370 Com.build.bekemal.apk -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText Com.build.bekemal.apk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId Com.build.bekemal.apk Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId Com.build.bekemal.apk -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock Com.build.bekemal.apk -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground Com.build.bekemal.apk -
Performs UI accessibility actions on behalf of the user 1 TTPs 11 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction Com.build.bekemal.apk -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone Com.build.bekemal.apk -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS Com.build.bekemal.apk -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver Com.build.bekemal.apk -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal Com.build.bekemal.apk -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo Com.build.bekemal.apk -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo Com.build.bekemal.apk
Processes
-
Com.build.bekemal.apk1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4370 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/classes-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/Com.build.bekemal.apk/app_apkprotector_dex/oat/x86/classes-v1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4444
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD560b930a8b3a464c74ff5dfdb649d5cc0
SHA11cb9addef2b45ce773de05cd12912456c55603a9
SHA25680d458cbf1e6871d86853c47927b11ea241707aaaf9c14e29f73e6ec1071e129
SHA51275e2ac99d68439ed517f2c3437483bece1244c0f8c4bfa5d7265a1fdb788911d5d64ff453a5bd1369bd18a5ee0c32b24dbdeb735c562720f339ae2fa8a44295a
-
Filesize
547KB
MD5a6a5c792cfa64e34b2437b5adcf13e92
SHA1ed4154fb5dca6ab35b66ab51159f3ac4d40dfd1c
SHA256ce0775853d85ec00625c9e43fb4939d4cadf425653ae6f8003d9346774579d71
SHA5120761675f0431dd55bc821bbd6ad16438295f8ced8409e55c124f832a1340c21c9157deb2037af752475e5a9cf0c8caaed5a5848f6e1245fe7b35a477c9def2f8