Analysis
-
max time kernel
147s -
max time network
164s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
14-12-2024 22:04
General
-
Target
fbf2cfec4149c76d57e217368a065625516b208f27f9716a148d659befc4897b.apk
-
Size
3.1MB
-
MD5
0c39a00d3187985946588e1e5ff58fc5
-
SHA1
7338e46ae9a4c891b4ebabb99da84b354330da77
-
SHA256
fbf2cfec4149c76d57e217368a065625516b208f27f9716a148d659befc4897b
-
SHA512
c615a78c8578a2e38fe2c3b589d7c57ae9f1d2b7f37b92592a239dc1b7ad02863a50adc66715e33e6e0010e546a643d2f8c35b3ca643eaa2f55cedbd549bb306
-
SSDEEP
98304:Z4YSZHNv3PZiNNox+o8z5TcC2tEDFX5q69UBYF1K:KYsFfZiNNoUoATc+DFXs6QYF0
Malware Config
Extracted
ermac
http://adsfgbkapmgnsdvbr.pro; http://adsfgbkapmgbrsgsh.pro; http://adsfgbkapmgdbshb.pro; http://adsfgbkapmgsdfbbnn.pro; http://adsfgbkapmgdsagbbs.pro
http://adsfgbkapmgnsdvbr.pro
Extracted
hook
http://adsfgbkapmgnsdvbr.pro; http://adsfgbkapmgbrsgsh.pro; http://adsfgbkapmgdbshb.pro; http://adsfgbkapmgsdfbbnn.pro; http://adsfgbkapmgdsagbbs.pro
http://adsfgbkapmgnsdvbr.pro
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cuhetobobeweceyu.gulowi1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691KB
MD5f454f516b011abc581e67ec65a574a8a
SHA1fd6d43376bd9b452d6d195ea9e123365fd366564
SHA256c2a0cc04f212d13e72a059e188e5cb6d44e558e5bb43dc620920c3a50321d448
SHA5123ba10fd9d970a18071afb6123ca2bd0c94fc91bfd29bcef9ef924feb840db1b794d733e5dea04a6cbd431c9cf656e62223620cc3b149d617a07eed41070c8265
-
Filesize
691KB
MD543439550e6da213a2a03a6856650fcc8
SHA174c4aa5937a2f40b420abd9e11bb348021344d8b
SHA256cb9eabf98f8cd0021992c1a6a72eea841e73c9bbeb2f6cb4da6d1c40ce2b5ae9
SHA512d2c495a083f8b1ef87653f1d0033c7845f9e038036f96de9405aac0fae9e52acaa296d62e538a16ffb61f87a2aabbf12bf7611d537f96be1246096ec37c0122e
-
Filesize
1.5MB
MD5f6eaab39f8329489b8a1f03bb43ce0b1
SHA11ad6b95b171367284d80ea9b73793616fb4ae9d1
SHA25689871e7fffc39cfe55afea95f995f0057b73d8174326a8582a3bd046cb195d82
SHA512ad1789bdd0fdd172bd23f581a0cc23ed7113671abdc802f7565495e04c5aa11076ebc7d45a6abef2d2323895317ae252f3644253ddc7562be547b32fee229617
-
Filesize
3KB
MD5f5be9546bef7874620ecb8f8d9efc46b
SHA1dd60615769e94b025fbb662d8bb328bcc15ee975
SHA2569dd27e885d44f4e0223690c83be6b2d299cb69db82bf655b3bfe2851967cac12
SHA51215a31998014022a868b4a5364b2cc506562fc2f96d5b3aa7580dcd3429786b2a05d186f422e19123117706e23f85809a81ab27ba95e403ec404ae90a432c6abe
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD531f5a6d2a8ad82d4cb4951aba23b8816
SHA1889b6e130834a76bdc6aeaab9b74e1e8f9bcd9ea
SHA256e8814d61960cb63f3f9a59b79a5656c1eb88fb9ea032b4c7d53701652be4ffb2
SHA5124da591007dc94e09878801f690c3dfbc3e430b4e58a1afe1459e59a16712e56c9e627813d91a5fc6475be3d518ae6883b967f07b1db3fa5584da376f8cce6b83
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD583610579c36c75d97990a255fbde0fb7
SHA185ece976bf4bed8661f739e7498cb256975db085
SHA2568e71722457cca3e3e73fe6e6ac7413279e542f90343cf0c1fe7f15bb76edeb78
SHA512c84120d3892096b286e0b8800aaf70884f4733f9922c4246f1cc3d58801a11b91caeb68d62cd1fffd486a870d34187045648740a1aba4f8601a4d10fc1a30ecd
-
Filesize
108KB
MD5d3f4a6220ef46e1c4b99d90b5b08e0ab
SHA1a88f67804fb01f2225c0d8101422c96ff9ca6a2b
SHA2561c6189bb674ca120b17c7f4b78d4c889b5e44b51421889831cd1cd8a555aa4a5
SHA51285003d71a762ee07fbf2dd01a7c9490501704c5349b5a73e9f702b2b0b68668bb725ad3fc530d210e4f8e6d639f07b254d62f17c2aacfeaa48542d1e27e11be9
-
Filesize
173KB
MD54a3226a75f3cefe9a4495c3101d3327f
SHA1dd0e89a5c12763f17db67c231ee16de30e738b88
SHA2560446e82b63f44959c6acbaa1b6d2136b743e3ab4cab17d3e555596061c18077a
SHA512f7a566c258efee43050c316e823fd27371d27188a61818a84cf3624ab78b4f9ee40047d6e02a3d5b25fe32beb73bc3f3d2d1bd12c3926616c44af55039c7f390