Analysis
-
max time kernel
148s -
max time network
157s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
20-12-2024 22:07
General
-
Target
0e6c87073b40a7914413479920e643f7fd3e56f62db2005d5f6e696cf72f6683.apk
-
Size
3.6MB
-
MD5
22d3b8ecd206e0d454927660e485c7c1
-
SHA1
12f83e5bfc939a331e87639ff932431b354b7a12
-
SHA256
0e6c87073b40a7914413479920e643f7fd3e56f62db2005d5f6e696cf72f6683
-
SHA512
9caac7f490081a3186ccd032bd73a44c93adef6e7f0e03c7edd7bfb1b5490588253b98d1c8e3eb66a4017b3009691de0bbf914b2af9bea181ab8a27ae1224353
-
SSDEEP
98304:kXJP4BVK4Fn/Wcz2YMk+4Rs/uUPPEWtG3vOVLIEmsBul5pu0:kXJPcFnOs2YD+b/PPcoLITsBulTd
Malware Config
Extracted
ermac
http://78.153.149.187:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
nusku.ermacv2.apk1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
309KB
MD588a0524f4a2f57ed0c1c25a550f9fc72
SHA109a456eb98dbe86427bcab886d5de15afe526c74
SHA256cd7a09fe9c3540cb21093c327bf4fa03b95a18ec8c1cd18b3f83de836895565d
SHA51243aa559876d75636b900f0cd023bf7c4082e5b66af8ea0185fa201483643cb9e523d43515b3877b298ceba8b17bcc40e5385e90c6f57425f0e17269a1abf8be8
-
Filesize
309KB
MD52adf8ab8c89629ba3fa6b68461370df1
SHA1c6e23af773ad1f11e19bc6b9d4a8028262cd21d6
SHA256361beae1571acd73c66f2ca6173d85c644ec56ea27d9816adb756a6ae9efe056
SHA5120dbcf456c57d93a4501589166cf1815ae02f18fa850a50851dc1db5ff18835ed38a85fee109140583067369413df4ec84c1c561e5683e44293baa9d34c3e5462
-
Filesize
916B
MD554e2b0e8c1ccd1966489478e8b148b14
SHA1f8464ab42c5945932131dfa57d435e3915b6e6c9
SHA256785ec4078661c8818b1d172d8a3f40377093f6a615119a903a1efc363e552906
SHA512dcc0bfb609febc534cb6df5099ada8e5ae98effbdde954e65e9f3f67fb7fe0317a8cf7549d7d9363220a15e83435cfd458513805ab6c542acb7f67e6b6b37be5
-
Filesize
682KB
MD5a964ac68c2b4714b22f487db4b6725a0
SHA13389c49334225aaaa0adafaee81d71809bf16df4
SHA256d1dee0e2441e73cd55d7cda257fe4a98140d26bdc08f31e61f8b00a71ffb2648
SHA512099b452c2e421f19e904aab91dd549b9c0b1ed4d2b5665792b6fcdaa0084f766341af73d6bab2dac447516815e7e59408487b1174dfe4bd0266b2609fd82e2e9