Analysis
-
max time kernel
130s -
max time network
157s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
15-12-2024 22:01
General
-
Target
4b34d41fc82c317c1d594f538b62f56a7957196a60eb7e6764c25b5cf26248be.apk
-
Size
2.6MB
-
MD5
beb6b34ca0306eaafd4e70ab0c8d28ba
-
SHA1
5384d75de226ce78bac30c1d7f9f55e237f54846
-
SHA256
4b34d41fc82c317c1d594f538b62f56a7957196a60eb7e6764c25b5cf26248be
-
SHA512
7eca21ac079fa5abfce567e95109f028d58c9b5b0ce403bd83af6d3f0a4eb2450555411b090b5eda0a54bcf7a6efc3df78fb415ee8aad41dda3e824f22379f77
-
SSDEEP
49152:Muv9l1BmBP0d2b3LnAC1KQfuAZFinujkVmW3G3s4rgP6kJxJaPotWd+JPhmPGTr:r9f4P04bMC1KFKiU8LJzcdgQEr
Malware Config
Extracted
ermac
http://154.216.19.93
Extracted
hook
http://154.216.19.93
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.xkllmakramds.axckuiri1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54615a237ee6a3d9c704a983f01f7148f
SHA196ed10d3f85331bfa0b7da9de19d0da3a6912b82
SHA2566631de9b2a71c89881689448e1892dd14966a20df8e05e63a22e224be8d9c8d7
SHA512222b6c6f0187c0879d4c8a98ecb877d382d1809fcf3a6c00469713fbfe30d018319039951284d272f23b5b49efd4c6a35d9de93f3be396af350e644fa76b18ef
-
Filesize
735KB
MD56b2b8859c9ace0bbe9dab74f1a4aa9a4
SHA13c44e335acd736d1b606172cf70b6f9315a8ab5b
SHA25699a9d6273d24b863ccb2ba78764d05d7e76832ca8efa7c5691cdf4c1f7fb17eb
SHA51282dd388539787396cdb11eb7c5c08813baad7ceb44167a50da6961a1229e026264f3b4563da86c9c5dcfacc72575f494acf9bb4fea211b3d1f00789feb843a13
-
Filesize
735KB
MD5bea1d844c540a13310b7ed070356a120
SHA1ac80642f903e98700b83518b3282755dc8a477f6
SHA25608d16be71ee0b34b8f0f50e882f0dccbb222cc8f490fd6d421445d4b10c52c70
SHA51268e21422fa247c78cabfa60c2af49df0e1326f8ffe18bd51bc2867eb574865a1f330368315bc950be0204f6a305b1e7223395f7972da22875f3a2e9f2d935e43
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD521cc5df4cf809f167b23d51cdda462ee
SHA177a76587c370c866cfcb71b6edf59bae7c8d70b6
SHA2562297907a2b2915c05bc00d91d2d11c64c461f9fd75bddacb58f6c8b9d4225933
SHA5129f194fcc80fd85fd48c3e23b4dbe875b5972bfef6270a2bae0e2e584f66ad572e34637b0bded7202c156dd0cc90e4afc0d424d14d07896b638707d4a0d414c5b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD52a5df27abb9bcf6a9b97867925b90a9c
SHA1aee2b987cb316b33e15c26c0a033bb6111c3b05b
SHA2564abb9b150a9d0b851872b195ed632bdbc5c750088e1b07e78346e9edb2559d3b
SHA51268ccc407a59a16b0b409e068ca7a9fcfcb36ab89c20d63756f227094595d377de2fd049105517c9a687dd0372f490afc8d0577d846718eef82f9ae14814487d6
-
Filesize
108KB
MD5e52ceac90f22b274b875e31b6a7f1255
SHA12c119d4f5e9f422a27a4879127a480a1a0dee25e
SHA2565b6826b0f1ecc4fb6d5d794f40a36a6434768fbfa6aef52daefb57689f9a2e65
SHA5121fa1836bdf3dcf4fc9a33fc74af514b0121b8881edfa6423f6469a5ded4fac6ab62f7ef9822052929395d85694143db52610428e26ff95f011a4da7924cb8957
-
Filesize
173KB
MD54b4f4d5a48cb5aee00ff401c282d13cb
SHA1e00e7854ca162226df6c61ef42b4aac99ac4ebd6
SHA256e9a36050326102a365022d277fc30664b00b4a2d74a9c34cc0fd6ecdb57c6287
SHA5128dc47619f34869fa68d994e9a6c5f0c40883a3b693973fc6bd260daf9d7441bf2542bc6d1b0db4d30d301cb935996d3b109f353192a20647cef5c1ee957b5533
-
Filesize
1.7MB
MD5b4fdddb3b461b42199b8ffbbd085daca
SHA1d64bd1547a3e1f4ce76cf5fb59a9b0ee1a8e0646
SHA256aeb7cd946a8b832e5bbdd3250a4b319a4114114457fde917dfbb50ff79e45c4c
SHA5127853bc5bd0ebd33f7972c2143f303137366777b794bf03c93ddf4f51e8844eaaf1dcb892c5322be6791dc8a00301783badb895f88dad91aa64a2bbcca90f9d48