ermac | 7ebf51ead710110e6bcbf2e5ee5f406a8c9612eaaa761efe03e6799e6b454883

Analysis

max time kernel
147s
max time network
156s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
02/01/2025, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ebf51ead710110e6bcbf2e5ee5f406a8c9612eaaa761efe03e6799e6b454883.apk
Size 2.7MB
Sample250102-bfdekawrdm
SHA256 7ebf51ead710110e6bcbf2e5ee5f406a8c9612eaaa761efe03e6799e6b454883
MD5 1366da46b87412e488ee0b5de8fa599f
SHA1 909f5a71a6cfeb6e1e462a54aada8eb059b505f8
SHA512 79a28e942a45c42123aaebd00c5f93258557bdce5b94524582cd2063816351d811276cea64c9cd3b120b52d4fa58ce31e8f4e174b58b641a0302aa722bdeb4df
SSDEEP 49152:E5rbR5enHnqELufS5EQqWXrgoliICXQ5EQUHm3GCjFq2J3EGkKtp55tqO5:EGKELufS5EQqWbtCwEjHQFq2qytTqc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://asoutlaverdadfasd.pro; http://asoutlaverdwwear.pro; http://asoutlaverdsadfaf.pro; http://asoutlaverdhhtrsd.pro; http://asoutlaverdcgahff.pro
http://asoutlaverdadfasd.pro
http://asoutlaverdwwear.pro
http://asoutlaverdsadfaf.pro
http://asoutlaverdhhtrsd.pro
http://asoutlaverdcgahff.pro

AES_key

Extracted

Family

hook

http://asoutlaverdadfasd.pro; http://asoutlaverdwwear.pro; http://asoutlaverdsadfaf.pro; http://asoutlaverdhhtrsd.pro; http://asoutlaverdcgahff.pro
http://asoutlaverdadfasd.pro
http://asoutlaverdwwear.pro
http://asoutlaverdsadfaf.pro
http://asoutlaverdhhtrsd.pro
http://asoutlaverdcgahff.pro

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4489-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.welogivafamo.kile/app_maple/DpTeAW.json	4489	com.welogivafamo.kile

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.welogivafamo.kile
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.welogivafamo.kile
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.welogivafamo.kile

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.welogivafamo.kile

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.welogivafamo.kile

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.welogivafamo.kile

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.welogivafamo.kile

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.welogivafamo.kile
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.welogivafamo.kile
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.welogivafamo.kile
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.welogivafamo.kile
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.welogivafamo.kile

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.welogivafamo.kile

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.welogivafamo.kile

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.welogivafamo.kile

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.welogivafamo.kile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.welogivafamo.kile

com.welogivafamo.kile
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4489

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

DpTeAW.json

Path /data/user/0/com.welogivafamo.kile/app_maple/DpTeAW.json
Size 691KB
SHA256 22643c95b4814290cdd83f540c98520e2ea891934468d6c25e08ec6ed70c958c
MD5 0351566aa9c6970376d0039a75800c30
SHA1 e6cd02ee02a03924416193e589fd58a1aacd53da
SHA512 2c5b27b4c432fe33cbb74e7c6fb5c2ba98c11a4b34df29f848136514976d981968ef95cb46548fcdf0f1599386251fe36c5a964a2469d5bccf93aa4df13511d9
SSDEEP 12288:Dit3CrKgdbio1Fegkv0qhPKF2pY29yvLimA5YMFRSZJYrDV3wy3in+a:Dit3yzbB1FegkJh9pYnXEYMdynx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DpTeAW.json

Path /data/user/0/com.welogivafamo.kile/app_maple/DpTeAW.json
Size 691KB
SHA256 c8899c5914638753ce275f4ed1b6f890f7e8e75389a7b7f549dd89806b6d9f37
MD5 91086c9f09f5e75574e536801269e204
SHA1 2e20488216f84cae4d46ae82d3804739c5a6e660
SHA512 54ae33f0337f8c7455757d664a8f5a388e9ec2d8e6cea509c962b35cced1134fae1cb7b9b932e8e6babd56a13aabf1503f80c76782eaa0deb9ffcd9200cc6da4
SSDEEP 12288:C1Sf2R4YVr7mqIsEmEUG78c0gb824mJUrAWho29s2l5IW+585T7gM9vY0n7Qy:w/dmxsSUe8hY7Vwsg5IW+58/Y3y
MD5 SHA1 SHA512 SSDEEP

Submit Download

DpTeAW.json

Path /data/user/0/com.welogivafamo.kile/app_maple/DpTeAW.json
Size 1.5MB
SHA256 e02dc22d555edfddfd8b83f946ec1825f0623809ec5a7fab6fe7f298c7196ed2
MD5 6b73cec9c6eaa536e99cf13e24912bb0
SHA1 e57cf5317a4b99e2fed2a8b5337b81bec201a811
SHA512 3baaea8d9b22f8bc1eccec4a8c6bca8a5286dbc1cecc00d281a2dcc4f4de724a1bb77dc6429559a73e27b4de4bf133747dfc5e448c3ed7d04fef3546e9fece42
SSDEEP 24576:RueWSXI/FgKcax1LvqIJV45arLG8hVfzAk8FSz3f1Gh:Ru4uUax1LvqIJ5zF3f1A
MD5 SHA1 SHA512 SSDEEP

Download

DpTeAW.json.cur.prof

Path /data/user/0/com.welogivafamo.kile/app_maple/oat/DpTeAW.json.cur.prof
Size 2KB
SHA256 1fc3fb1ff971940a11cf1b0e4127ff60165dab453e417b315d27caef1621b3f2
MD5 96fd36ec2bc297335e1a537c1764cf15
SHA1 7f3042c2eaec86b6d2a9173806e1d5d2278ad1ef
SHA512 2f4a0bf6ed0dca69fed1cd0bb350a19e21e21e33edd07e2047986e11ef957e2fb8ae6ea45c63bd5f732e7c36017af1f851fd4c3816ef10b423e89f8fa6bf7691
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/user/0/com.welogivafamo.kile/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/user/0/com.welogivafamo.kile/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 fbf424b06c0a5be52d57fad0e8dd91bd32c7e7b6a7568e0cbbf1c943d35b54da
MD5 4126a9c83361264f99c7a9da4f634f76
SHA1 9dc3e7c5b64812e93fa64593ff9188ba4944bc66
SHA512 c9ca02ac53a020d2c7b65665d2d11d9f81e39f60b3155546168c5f53a23de0f1f058a06e7882882b1df2b311d05ba21ee662f370c125822511a02f4302294c8e
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/user/0/com.welogivafamo.kile/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/com.welogivafamo.kile/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 4f060d908272dbfcf393a6478829a6442e8408e6f58d4cdbb8ecfebc0ade154d
MD5 4e0a2b784e962fa4179a8345c68b8c00
SHA1 003e70be1a891d3cb0ac8dfbf60a09843131f476
SHA512 772309100e27f125aaa34abf4c62150799ff3091dc99ef182c7cca29f927272eb381eca18a79f7bcd42f260b869a8bcf32c772a2b174b0d5bf55c73235a56401
SSDEEP 12:Kk3Z1dLTzdeWRmBEyPbP/cGW61LtC1tl+Ow2:KiZ1dnzKGSP/cGW058tls2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/com.welogivafamo.kile/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 dc506e0bf0d38fa399a7c328043f5ce1e987a7fce85392eaa25873067529f3ca
MD5 759936bf7b31cdd8d8e683e2918f3faa
SHA1 113bbe8e74941859e8379323c87e89bd72d8142e
SHA512 801e0ab8f6c82ddaa7aa4dcf7d32b558ebbbeac4107e59001a0ea3caa833bf74dfce1f0509d0c4de0ed56de7d45e1bcaa475ee7556eed516d057fb0cece896b0
SSDEEP 96:akZ6+hdjnHtDRMpf8UzS5+TD8q0ExPHtKIl5d:hVdjnHt9Mpf8UzS5+TD8q0E5NKIR
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/user/0/com.welogivafamo.kile/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 cda38b0c4160dcbbbb93946eac8d371a38ec78dacbf06a001c5f3910c18e6142
MD5 501b16642fb8d90c5c0a0574e39d9d23
SHA1 c383fe9f5350db37496193aebaeb986492f763ef
SHA512 57c3c2cde02ea92d5ccdb3dba89c2b222111b345d1d56d5e4cdc7a33e40741005f9374c8fa2923d3e2a87dab6818d8b3e046721bdc3c9138bfb9dbf097ca58c0
SSDEEP 24:USxwcBebYfA0HjSR6Ps7hqcBT8fdELcBT8WvZaK86B8nTER/xwcBebYcS8Chsr+/:7xDBOYzVsdJBw1Bw2WLTW/xDBOYtO+gk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads