Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
10/12/2024, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
a853acc5980a78a38ca9fcae6af28ee5f7d3b340bade3100662c0513900ad886.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
a853acc5980a78a38ca9fcae6af28ee5f7d3b340bade3100662c0513900ad886.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
a853acc5980a78a38ca9fcae6af28ee5f7d3b340bade3100662c0513900ad886.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
a853acc5980a78a38ca9fcae6af28ee5f7d3b340bade3100662c0513900ad886.apk
-
Size
3.9MB
-
MD5
2fc13d55c51d99bbef6dfc84635560fb
-
SHA1
253239489f7d8c255f55311c34a368870c556d5b
-
SHA256
a853acc5980a78a38ca9fcae6af28ee5f7d3b340bade3100662c0513900ad886
-
SHA512
46cc5cc214d184418f90c22c209b7adbf4b40236f3182bff50bc60559fb8b86b4ee3d06c26b79d3d447322a5796bafcf3e04d6e5e5a314f57d780b42bc323272
-
SSDEEP
98304:HJYWxHpGMbWrEvSt5p3EPY5Noig1aSRXS6UC8NCow:pd1IMbWgv+LNvg1h1YC8NCow
Malware Config
Extracted
ermac
http://154.216.19.93
Extracted
hook
http://154.216.19.93
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral2/memory/4943-0.dex family_ermac2 -
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.numberfasf.StickerArtadxjl/app_merry/UtlQr.json 4943 com.numberfasf.StickerArtadxjl -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.numberfasf.StickerArtadxjl Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.numberfasf.StickerArtadxjl Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.numberfasf.StickerArtadxjl -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.numberfasf.StickerArtadxjl -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.numberfasf.StickerArtadxjl -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.numberfasf.StickerArtadxjl -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.numberfasf.StickerArtadxjl -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.numberfasf.StickerArtadxjl android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.numberfasf.StickerArtadxjl android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.numberfasf.StickerArtadxjl android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.numberfasf.StickerArtadxjl android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.numberfasf.StickerArtadxjl -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.numberfasf.StickerArtadxjl -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.numberfasf.StickerArtadxjl -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.numberfasf.StickerArtadxjl -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.numberfasf.StickerArtadxjl -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.numberfasf.StickerArtadxjl -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.numberfasf.StickerArtadxjl -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.numberfasf.StickerArtadxjl
Processes
-
com.numberfasf.StickerArtadxjl1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4943
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD50e0fd09fa3c1228b3c2e0f9efb861334
SHA148a25078ffd892c7a99e8d5e019783b4a6013a4a
SHA2561519d19e3ab47fd0b3fffeea53825f3e533853ee05e9e92fb01abb6cda2a0aab
SHA512f731f1a8c69375a69678b6268bf8e460fc8f079dbcc3b7cc72ae047c25be8c74d4813f427643923cb5985f11ee9d1873988f9811fae3aa7b4d8fc70336572906
-
Filesize
735KB
MD547e0aa5a0d10546fe71fc2e75a69fc6c
SHA12006ae37058d20484a4d2b2396883c94d111773a
SHA256bc443e6f9dd366d3fc31ae6c5be33e4ef7c351659e9c2d60126bab6bea85eb84
SHA512b635f3bc71a63108c8aad9c6be8e8904f112d1dd7e09ccad31b05de8ea5edc904334c3c0334142a48377c1a04b357f932c9e54e3e0e70eea9d45647e42aaa410
-
Filesize
3KB
MD5c5432d076a83a7d939617ba5abe05334
SHA1cafee4d1e88e1e54817860889328accfe27cdf67
SHA256ca35bb00dd9020b8b079aaae53c078dc121f581c059784b06292806a04159856
SHA512d504d0c7673a6eb06bd41f1a321bc063d464567567c26c648f2e5b68f5611f4acaefbd510bf65e0c624efc07d57aafe3f572aad514a855b0e9f2cdfb4a6c5655
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD55c6ce1a7f110adebec2a17a7b95c5271
SHA1511df3f652fd79132beb01d134f90bdb4c1b2743
SHA25605714eff198da7b975978e7daeff89bfaff0ae120fc37a8ed8f524f970d5814f
SHA512fec528a2ba46f769e198e54c7ffa15f65263a76cd7b632ae6af25de56bc613da4f52616556d85d1e91ed759779e1dc9cb9e168aae07786b1202b1446388cf9c5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b0270514f926a6081256301b8c9def22
SHA19a988fddc256cf173dc7f02444fc9b590bc2ad92
SHA256fe9ebd628629d65a0a10fa04d323d991513e4e23707c8f295ca6369d77452b7d
SHA5126b1ddf7b842810897ad4daef732269af358affba9eb3c0f7214f2d75d08871aaa4cb20bb46326544fb1a1998a52dd2cfb0c2a6e7e6f53aac3eaa0d97380c19f0
-
Filesize
108KB
MD50593bb1c803780c42cb650d14d462fff
SHA14b348dd2c724c4f2e98c0d9a306e5bc1e5e98b15
SHA25602bb7654187c62220d38e371e7e36fd57d956e1f18206edbf9cdf9a800fb522c
SHA512791697cfce1265c76ce9d671bf0bd983ff4a5ef36a98db9baa92701c1aff6bfa91637cb9def4d40e19c008810e4063f2799749574e739afb62f7a898bcb6b5a1
-
Filesize
173KB
MD5a24696a036ba3cc943c7787a676ea151
SHA119ac6658dd7976ad9921743aef18490984dde7e3
SHA2568110979f51ebb0a08d0f2032913409dd01d5de9405b08a851471b1b9b57c7205
SHA5126442a1fe3fc5852b18c8e9e7db237ff5602cc17d300f07f88fb06801ea9e58d8d798e8455fa791eeb1c7c22b24003206845a4dc7351bace2486630aad287354b
-
Filesize
1.7MB
MD5b99c671f34e13773893a5ce44c7f43a7
SHA1818419a336a3e0f17572cdd1f0d363eb005c8de6
SHA256ae6b6c994ddb5b9ef0329de8aab60028743842de3b1717479b2d91835ec17a58
SHA512ce80e7ffce3a1e2385f886d2b9fbfb7eec88b7e5f76e25abfaa6e6601ceeb1c3b01f8e91dda2b9d9d5de06b122a4523a867262a402461261d191df628074c667