Overview

overview

10

Static

static

6

da7ba201fe...67.apk

android-9-x86

10

da7ba201fe...67.apk

android-10-x64

10

da7ba201fe...67.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    16-12-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767.apk

  • Size

    3.3MB

  • MD5

    3d2b54c57641edae6a1f427c8f4e8de4

  • SHA1

    a52b480b33faba2c802d13cc91e09480988b2b98

  • SHA256

    da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767

  • SHA512

    573e779c603d8446a00508a38b70eeb7454c8c62cbabdb0fda9e53831e374253b2e9b0db115e488194f8b2143de40f6deb7c6347193886699717e39d98dcd575

  • SSDEEP

    98304:xjcPtGFWKttiZfiQZKa7YKnqaowJzSQk7/LY950d:8tutRIECoXQkYbo

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://adsfgbkapmgnsdvbr.pro; http://adsfgbkapmgbrsgsh.pro; http://adsfgbkapmgdbshb.pro; http://adsfgbkapmgsdfbbnn.pro; http://adsfgbkapmgdsagbbs.pro

http://adsfgbkapmgnsdvbr.pro
AES_key

Extracted

Family

hook

C2

http://adsfgbkapmgnsdvbr.pro; http://adsfgbkapmgbrsgsh.pro; http://adsfgbkapmgdbshb.pro; http://adsfgbkapmgsdfbbnn.pro; http://adsfgbkapmgdsagbbs.pro

http://adsfgbkapmgnsdvbr.pro
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.halusufobecaji.taga
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4212
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.halusufobecaji.taga/app_mixed/FUF.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.halusufobecaji.taga/app_mixed/oat/x86/FUF.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4239

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.halusufobecaji.taga/app_mixed/FUF.json
    Filesize

    692KB

    MD5

    149d51b63c865dc812f58a113f657b39

    SHA1

    b1833610a88a1f84f42985e803a97ae471a8ca4e

    SHA256

    2dcb1c510d62648c3385f044dde8c215b1031564050dab687dc91ed849ce3c48

    SHA512

    dfcf58bea432e0d09e17cf8ef658c219472785a9ab22d48bc8b38579a301fe26098cd6cf43e98851cb110a9f5593b952a60ed34ab72380638c32bfb9e4df12cc

    Download Submit

  • /data/data/com.halusufobecaji.taga/app_mixed/FUF.json
    Filesize

    692KB

    MD5

    49ea697ff363d2d21fdfd794dd76bf46

    SHA1

    3b952314d7c96183461c0f80c5fac013e5cbc878

    SHA256

    a349c2f9ae34d8313dc0f129ac63b8e3e08ff62b041d44083e22501d9a42c575

    SHA512

    e097455bc46a11a477152c401c78aebf0a6144bc6fc0480e0ea282f8b62d1b3c31c28565e889a1d1454858ba20bec9c65e609a3b84c1833d358b6b288386745a

    Download Submit

  • /data/data/com.halusufobecaji.taga/app_mixed/oat/FUF.json.cur.prof
    Filesize

    3KB

    MD5

    76797b1d050bfcd6147145eb4d54f85c

    SHA1

    4a634e250aba118f2e8613024227ae326c6d2ad6

    SHA256

    a597ca19177d05da8241ddbc01fb5a94721c4bd675bb3bcb65f2ec047e12e90f

    SHA512

    a1daa490cd21befbadb105e22c0d68467e1aebca23b89ba54d26ae007f9ba46e2cedf56f73aec73e656af44d824e6e058be431351d40600c2a76bf55b1536450

    Download Submit

  • /data/data/com.halusufobecaji.taga/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.halusufobecaji.taga/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    7da5c48f5b16aa77fb359dc5f472e0b7

    SHA1

    345d99cb5fa50b8e196aa86320fd56b87ef6391f

    SHA256

    83cd285efd3b97fe7abe13fe164ae2d38a5dcc83c4803ceb1b0f71502e2d7c6e

    SHA512

    307fbc0eb053935133bb57e80895d8b8cd35ad4098dfa61966c770e3c70185eb750bfa27a3689d7d4dd944b9ba569f6a7bd1468ac0f37536e64376f73b5f6bfc

    Download Submit

  • /data/data/com.halusufobecaji.taga/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.halusufobecaji.taga/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    7168319d85e89e5faa0a4e07ac66f0a4

    SHA1

    8b9dac4516c38b1276794acc721bd57557e551a5

    SHA256

    6dd3b384309886e7f6cb8ccafbdfcf14f0fb305aca672ab8a356a06bdb53b1ef

    SHA512

    2cf9bc68ed2a5c7f2de5e03ca74ebad699e7fcb200c77752de3f59e7a325ce0d739b4be6dd03700352703c6c0dbbe739bd4f13c93f5d1ab62494f8ffcaecd9e8

    Download Submit

  • /data/data/com.halusufobecaji.taga/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    0e87b867484511e41b8caac74820cda1

    SHA1

    d2e4d89fbbefefcd4dce2d3f8827e06110c2a885

    SHA256

    1826349d89d83b588afd25c1d66d2ff83a690fbe3067dfaaaaa308359455f3fd

    SHA512

    b7c4865cecdf57155871ace5b22df74ade722fc797b5666a491417bb51c1699c2ad21bab70c7be5413dd27af6122cba01132e6ea1bead3e0e768c5618be606c5

    Download Submit

  • /data/data/com.halusufobecaji.taga/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    acdf505a231c59d6a41c7db9b4c53893

    SHA1

    dd036c1de6c1ad2059a0237fba7751aaebe66668

    SHA256

    72e44d0b94ed4277427ce9e35d7f3ea5d07a81dfd71115dd44da8330469f3038

    SHA512

    10bedc915ae62e0e111d9cff663e77ca483744ddcd84bb179648e9c31a729ee7d71819ebefde3281c1b007dcb6a7f82be5122e18f81e9c4ff8d2a2d388e0abf7

    Download Submit

  • /data/user/0/com.halusufobecaji.taga/app_mixed/FUF.json
    Filesize

    1.5MB

    MD5

    43c4d974989442df82f377fb185305f1

    SHA1

    8874a00648591d923a40fe48cef823f7e65b5d5d

    SHA256

    38be8863bbea6b0e5624a6c228578045f464e992a9fa677b9e2e4f11f93f4130

    SHA512

    327bceb6971c5ee5324edecf450738bd4faf7f2f8c306b5b7891e269c31b5de4e35369435e5ae977cc74712f112c516f8dc59c7d74067a268b57cd12b1a97251

    Download Submit

  • /data/user/0/com.halusufobecaji.taga/app_mixed/FUF.json
    Filesize

    1.5MB

    MD5

    2bf99514b8299e66edc0d91660c23580

    SHA1

    2a2fe4ccf1ac80dc9644d80ba56636b4a5d386bd

    SHA256

    4fa9323ec828dfb9f2dbf571588a86987b1a5fd4b28f51633db49f874598f724

    SHA512

    7bfc8a190fb80c24e10fdec2687674a4f49182b063d1d92ab6a171aa3f0318570a34d526e5a5d0218e3e708fe012d36d117ac8820aeba02b3494e9b6f528d8ff

    Download Submit