Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
12-12-2024 22:01
General
-
Target
b7672ab21441af12cd18cb07017ec204772639abcd190b6c0db129cdde6869a2.apk
-
Size
3.4MB
-
MD5
8597c427916067bd8c9e51b21d2358fb
-
SHA1
03e624759d2d7ee202a57f05b3a416adaad3af5d
-
SHA256
b7672ab21441af12cd18cb07017ec204772639abcd190b6c0db129cdde6869a2
-
SHA512
0fe969d4877f836cd7ba295635fac881dabca516b02fa3e2fed5d739076a5f4461a1242d16991b3b840f0dfe13ce18131730739fb40fb1a08accade66d74c946
-
SSDEEP
98304:C5Vv/hgeIs9LD9qy3T3Bv20YVqAlh8LgRvRhlCDQ:Es8n0eT3ozVqi4qvDlCDQ
Malware Config
Extracted
ermac
http://154.216.19.93
Extracted
hook
http://154.216.19.93
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 18 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kamatkap.mafuko1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
MD53eecc2e4a241bed02d54df56ac9e7c2b
SHA111ca54c267ebf6a8e1a07b70bb3d0aba60728062
SHA2565c96e2a6bd086692459ac7427a2990d4bff6b4ceb576f2a1e99f9452d4089c35
SHA51207bf838883df4c0c167736af481d1811d113b211e55d9c6bcd2e5e5cb169be9ee03b179ab59153fa905317d2db26ba2de65d5464b8393045a4a15e31c0e45534
-
Filesize
736KB
MD517a9b0eaa067c313b23188d78efdd3e5
SHA1b220cf0f634bf76378369ee0dbc09a536d0e18d8
SHA256ee72805e8047d1d22cce1818dbb216139c2f2e623ec2994e0a60309fcbeb630e
SHA512330d5d37ab6f6e68bd2284a790f063769d097bcb2d3f0b261fcc31a4de0b5b41eca577e0c63c79d517e2227024d673fb94e7a453f2597255de25f836e6bb9530
-
Filesize
3KB
MD55b8d283e8b5dbe254ce6b539409aa39c
SHA1830208f60ee3668709f92189cb6dfbd7713a5b96
SHA256dfa4b1a66e023e33b41a741c450be1e07d8c9c0cd4510a140d3b2edfdc51995d
SHA51212eff260d1d8c996d1f24a9d6a7cde5e9bfe25548091b2229a6d328ce3f0442eb46c224092429e3dc5768a8dda1d07bea8e4636eafc8cd74c14ffa75c62e6786
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD59fb9c17045df7e975377d97a1928fddb
SHA18e1deb1a0d4f0ec9c5424878682c24716c5e9207
SHA256cff1f8ba46e6130fd45cc087c5633a166e0626774c00be30198415a3a9426de6
SHA51214362b3513f9a3a1a00a32e6a7374334db3ebee4111e39e4a963007dc9d624d934d964e76235df6a163822b5061739a0055e5ed7abb3f83ee5ea35286fa42dcf
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5eca4584647cbc3d66f7879de823e8810
SHA1ad82be7d550edc70d6df739eacc88911d73e1be6
SHA256cb31359cefe9e57049eb9e7ed9d4d5ee58bf91bee2ec2ef39e65d8e1786a55a1
SHA51280d5a7acad34eef3d97efd2a6e9c03a537b5614cdb451d4287e5a5a8b840b91d4c358598dc8816f74ceb14fc95c504c1c71b1fb33dcee9b5e529c6e8daa739cb
-
Filesize
108KB
MD5fe1bae5aad82372f2913a4daf535c712
SHA1fd5fe3be127f5341f6b7c8a99d85186191136541
SHA256d09601fc79ac32b43d5a093cf91019b006372e8d720065012526f3444b825385
SHA512e0d3c0bf36e37c4b43557a668fc6e0ab72760490ebe5f18615ca5f5278e057f854ce5b0605f18a5bd107b16bad9618aa9de0a90d568edfc16ffa6353e874a102
-
Filesize
173KB
MD555ac0b1818d456165423da23b3f6831a
SHA13d0bb77a2527eaf2f5b8b44be4eb2e84bdeeb461
SHA25669e7211705f2e344816a1cb8c9197dc077a72513f4b31e4cd67da19a9d6e0208
SHA5124c65a8d844e3414ecb2e1240d8d3affb1a5ee6d881520467d31cad1b713597dbf6f570948a25523be76656b6658e422a5fb4ab569080d5af2cd7a73328d26c09
-
Filesize
1.7MB
MD5332e75f1e51240a01d136055c2a31788
SHA16d577e35bb5162bd93c3280827915a81da441838
SHA2568429ac18967aa2f7aac10d6d3ee6354203b7d5104acc5ca7f62f33e5a81df17b
SHA5129f1037a551228f382aa5545f80a8c34e99f6b3c5b434a39474eff301c675885b1be9698a6b740ed9664b65ffe45b34d7d32a7ad06c39537fa2cdf292195d8d30