Analysis
-
max time kernel
148s -
max time network
157s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
09-12-2024 22:06
General
-
Target
03185ce771a6617d075d7acbbd8ea8a3c23028a174becb1b09142cbdac0818ea.apk
-
Size
3.7MB
-
MD5
baa302010d75f530799675536e79611e
-
SHA1
3e9b765550473f8720bffbdb617a24d952df8ebb
-
SHA256
03185ce771a6617d075d7acbbd8ea8a3c23028a174becb1b09142cbdac0818ea
-
SHA512
54cf97b51bdddc5ee22df2758d97acea2d9b8874641f976888481b927eae1ba4acc70d360592a62c0a4cbaf7c74b3187d0c7df6d7ab02de301305844ae0fa643
-
SSDEEP
98304:IMOoHD4A/zAy49cHjOkJHrL9cEJFD9t/a0fmU:LOoHD4Dy49ciqrL9cOFJt/a8mU
Malware Config
Extracted
ermac
http://154.216.20.102
Extracted
hook
http://154.216.20.102
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.numbpaerfapapakasd.SticckexrArtadxjl1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD57bc56bbef3a09ab77c1c2cb2217a4cee
SHA1b5d1cbcc180ae0e83365f25a6167fd0ab1e58234
SHA256a666af99355bcffc87d3458fc0982a748e6588a72a464b776dfbcf23dd569a61
SHA512e192afafaea986ac13e094505dc1960620d01daa43e1d60a85817d412d347ecbcb5fcced95be4fb7917483d390080042179e38b849b05331bb18911a8a361e5c
-
Filesize
735KB
MD58848c42f2bfb83c6a780979ef9ffef1c
SHA189baaef3d716ee6384ed848a8af152d1a1f4fdc8
SHA256db9936b329e7d265dbe5e4f9e296106ec7924d7e69cf73a49d646daf53ba4faa
SHA5122164a9140d3219ded79b3fd07f094249637ef7a58ade024e0fdd4f48a96a327b6b12459719ced162ce528c18c6294b5c94acb042ab9bc1e3235eaf13cd993190
-
Filesize
3KB
MD5f9a75beb60a40503d864571daa71b06a
SHA10d132522f6496a2d956a5da4c9b0a9e5b0d8849e
SHA25619401ffd077c39af7e6523dd65d0ac61e9d5747fe5e94aeaf7f25a40dfd0b427
SHA512a4d93e1b70c0b04f05547abfa7cb251790e5cfa1db5ff4a1706ffd16f099f3458617765c0ff1e83753e0c90e317767681b698e751fd21aab6b3cb483bb1bdcbd
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a44c7a99bc5067294512f76865d2ce0b
SHA1dad88766712b6a6a7ed3b14a20d0e8c24b3d1557
SHA256989d0eb509b5d7b4b74a6b2213a9204157071c2ad6663c1976e4c0e91ea166ff
SHA5129e16a64c40ae82323c835657e5363ddd44d86668c4da34e578576c928d324429092f5940273e71cad535f261628b0d6531fcdbe0bee59b0ef4540c3c5e73ef6d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c2e7ed3eb17c284201775f65fb263980
SHA1116f37c47ea4a7eaf187fc73986e168185e04dce
SHA256528fb2bad9a926594ade5ceeee9daa4af86370da072e1ddcde50f3037d4fe1a1
SHA51214f7bfa0003f097ae392493a5a11c51f75958dd1ec8f3f646eb45a58c09b2de5f1af8cb244ed0686caae39d9a66f056af8576f075be73dab85bb9567d5deb582
-
Filesize
108KB
MD58488ab4e2576f0ac764a86fa553a3535
SHA1374b7537dc06f204ff2588bbbb81c7b676bc2d15
SHA2560af362f65ee18e34c1108cb5fa01c4d6e79da82ed2f3d6d32a1ae5486bc846bf
SHA51281c0812a6cba9fc0518dbc92b9adb15b4d75f6c9bccffd702b1355a1508207d5a55b191d173ad3ee5282087483c4fd0006785e927fc061806bb04140fb8d835b
-
Filesize
173KB
MD54ca80fb7dc9468a0c78b0ce4b2e1c321
SHA1bae5280203f810e18004ce22c8a2b176302ee901
SHA2567afe3f445400741a6ea9943237b99f39ff12ad9441d414723867f254b090ed48
SHA512c8b4f1bf1d04614922871c82b3cad5a4b9989b8a2ead15984fd0e60dda69e2afe1d1e89dd0315a809435c3b0841edb7c73987f9c405c581518e554272c7b78cf
-
Filesize
1.7MB
MD52824dc25807271eeb07d4fcd6b0fa0ab
SHA1393cccedddf4190a488ac994ad43f80b89da8d34
SHA256dcaaf380692c2961c20719febb55bd07cfde57feb2b2496adfe7bf85efd63175
SHA512fafa71527697092af031a692fb2bd5c9e224784e75bcb19c3f3c225bb317f23f2dd0b774386cef6af147afc5408694f446051d680fe09ac69be0b402d4bb2a3b