Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
16-12-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767.apk
-
Size
3.3MB
-
MD5
3d2b54c57641edae6a1f427c8f4e8de4
-
SHA1
a52b480b33faba2c802d13cc91e09480988b2b98
-
SHA256
da7ba201fe7a8ac29b53f634237601721eece9b0414d052df3b9508e90216767
-
SHA512
573e779c603d8446a00508a38b70eeb7454c8c62cbabdb0fda9e53831e374253b2e9b0db115e488194f8b2143de40f6deb7c6347193886699717e39d98dcd575
-
SSDEEP
98304:xjcPtGFWKttiZfiQZKa7YKnqaowJzSQk7/LY950d:8tutRIECoXQkYbo
Malware Config
Extracted
ermac
http://adsfgbkapmgnsdvbr.pro; http://adsfgbkapmgbrsgsh.pro; http://adsfgbkapmgdbshb.pro; http://adsfgbkapmgsdfbbnn.pro; http://adsfgbkapmgdsagbbs.pro
http://adsfgbkapmgnsdvbr.pro
Extracted
hook
http://adsfgbkapmgnsdvbr.pro; http://adsfgbkapmgbrsgsh.pro; http://adsfgbkapmgdbshb.pro; http://adsfgbkapmgsdfbbnn.pro; http://adsfgbkapmgdsagbbs.pro
http://adsfgbkapmgnsdvbr.pro
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral3/memory/4655-0.dex family_ermac2 -
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.halusufobecaji.taga/app_mixed/FUF.json 4655 com.halusufobecaji.taga -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.halusufobecaji.taga Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.halusufobecaji.taga Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.halusufobecaji.taga -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.halusufobecaji.taga -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.halusufobecaji.taga -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.halusufobecaji.taga -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.halusufobecaji.taga -
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.halusufobecaji.taga -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.halusufobecaji.taga -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.halusufobecaji.taga -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.halusufobecaji.taga -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.halusufobecaji.taga -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.halusufobecaji.taga -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.halusufobecaji.taga
Processes
-
com.halusufobecaji.taga1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4655
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
692KB
MD5149d51b63c865dc812f58a113f657b39
SHA1b1833610a88a1f84f42985e803a97ae471a8ca4e
SHA2562dcb1c510d62648c3385f044dde8c215b1031564050dab687dc91ed849ce3c48
SHA512dfcf58bea432e0d09e17cf8ef658c219472785a9ab22d48bc8b38579a301fe26098cd6cf43e98851cb110a9f5593b952a60ed34ab72380638c32bfb9e4df12cc
-
Filesize
692KB
MD549ea697ff363d2d21fdfd794dd76bf46
SHA13b952314d7c96183461c0f80c5fac013e5cbc878
SHA256a349c2f9ae34d8313dc0f129ac63b8e3e08ff62b041d44083e22501d9a42c575
SHA512e097455bc46a11a477152c401c78aebf0a6144bc6fc0480e0ea282f8b62d1b3c31c28565e889a1d1454858ba20bec9c65e609a3b84c1833d358b6b288386745a
-
Filesize
1.5MB
MD52bf99514b8299e66edc0d91660c23580
SHA12a2fe4ccf1ac80dc9644d80ba56636b4a5d386bd
SHA2564fa9323ec828dfb9f2dbf571588a86987b1a5fd4b28f51633db49f874598f724
SHA5127bfc8a190fb80c24e10fdec2687674a4f49182b063d1d92ab6a171aa3f0318570a34d526e5a5d0218e3e708fe012d36d117ac8820aeba02b3494e9b6f528d8ff
-
Filesize
3KB
MD5dfd14804b100ce4ba0112924969768b9
SHA1adcf80bdc97cadc76498f11371194922bc7563bb
SHA2569ba7f63fde1512e1a6e8ac6d4625999c16429f97486343d446286b5dbce885aa
SHA5120b72287efd4a5ea037a99804600ef93b70c2fa192926fb901595266c70e25bfa1168419132355b2925afc3cbdbc2f2495a640fd408f68cd31769b1ff447a5220
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5777007fc4927c010b9e2fcb6a9701133
SHA104cd32d7e72a0515e4abf89654451d9f0fb1fef7
SHA25667e658bab2c8944a4ae90ecc5ebc32454e67079709ab75f5f0cf9add3f524b37
SHA512b8d21ca99705ad1042630ad108cfdb9112f4d12201c33a89e63a423213b6a0d1fe2eeed501faa4b6eea6ac88201a569d3c88af5b0fff1d31637416e4a3cb4563
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD53ab7f624e6fc7f9ab5ce827b0e952b6b
SHA10f44cdbaae14da9df19b56fef7b20718fed90b59
SHA25689a756c52af552fac1549f5f3a502ac501450b853dc4330d906678ef9797dd27
SHA5124bc914ea662376248ea254034e01795a3c1a35fd1ffefe924306de4c5ec51bc488dddd65b6943e67635ec2ce37297d1401223b27210837368840fbd822ae3c16
-
Filesize
108KB
MD54fcb77c319c76221980dbbee1a36aab9
SHA125767f48383e7d8dd8b913249f661b292d17b8f9
SHA256296a336d6fcddc20e6ac2454fc3d3b344259c2a9f25f72cd97aa7d2435b74fb7
SHA512e564d2e53abd87040943c1ffb4cbf6f5a5e42fd5f3b87e7ff55379810d1a13635575f745ea741fcd41bbe197ba36ed82cf5f52748a2528e54597e9094979d978
-
Filesize
173KB
MD520463d5ff84943c108b936aae11ea10c
SHA11ae94766efadeea56c9d137b5ba1794594eec494
SHA256b9964e3026a86d0535db1cd3c16a49ed8673b68d8fe54b4f1a46b019a9e40c8a
SHA5125c128e5e54aa8bc016cef29e43115f6f6ab5128ad280a8af099ae6d77de978bdc71762591b64e6de9ee97df332b0d4f65b38e4c0d8933e15617570e967cf76e6