Analysis
-
max time kernel
147s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
05-01-2025 22:02
General
-
Target
595e4b0da43dcb9b349c506d6d3e9d1a3ac077992bd84e494d44100479c04386.apk
-
Size
3.0MB
-
MD5
6c43fb723bf1cd6b195fbc1395aa2dbd
-
SHA1
9a8e71e125cc5bf9a5b7f4e833a98d0a36ff7ee3
-
SHA256
595e4b0da43dcb9b349c506d6d3e9d1a3ac077992bd84e494d44100479c04386
-
SHA512
e2b0f26167709972aafb321beddcba09da4dff08afe9987ab72c8996c8a2adb17b1af1c9c3ca224dfaae9642083408bef4b58594f635115df8866e96e738b5aa
-
SSDEEP
98304:vSSizZkTHucoyLfDKsUg8ldPamyB4CVj2NBG2mXgmZD4R:6ZzYKnBZ
Malware Config
Extracted
ermac
http://194.33.191.251:3434
Extracted
hook
http://194.33.191.251:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cogubocubeka.vewo1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
687KB
MD5cf8f5e8d118274f56ba08ada133acd01
SHA15e9a5a5686e92bfebf8326a76911505072997784
SHA256f8f294f5a3c6ffe8ed1da078d07d3b1f13f7d78ecab081c29853058ae8fafa00
SHA512d47334fc5aac66c9fb745aea8960912fd5a6f05c7154f922a3746460e1806dfd424f7f788dfd68d8eb17c6e5202be0a97a5167de0012277dd7022f8541617075
-
Filesize
687KB
MD5925316fced47f2a806807e400f0845c8
SHA189ce8a88fe0d04baa0190e7614f961857b815371
SHA25613239f29648c9e04a8d2c16bad4d03ab37f9f87b2a574148f64734589bc5686f
SHA512606a1d6cb9642795ad248d7a7fa09b2ec46d571ce6481a9576f50db9344e0bf1c38160526539837c22e28525ee3ca8a02d22f0ff08d02c176394ae979986f95c
-
Filesize
2KB
MD5f2fe0a866e8536228a062656824e172f
SHA129c12df868efb6990a378739bf35d64557b89b94
SHA25633f1f8aee52fe3953a7b0073ceaeac2025358a9dfd6a69279693b640a206bbb7
SHA51244e8f098564b5510695bc2eacb6ff967e36a84f14a8b3328dd42d0bccf631080769678c464038d424837473b452658760d64e2bc96eced0b4e2359119f02ad5c
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5ac72c63596202df0dbccb3cee4b32af9
SHA1c9694408e7ff0a764efdb529e8010a090d22bef8
SHA25613893badbd0bc7b3588ed272be5e223d394c29304b425603fa2a4ed46226e700
SHA512b5cfb527ef04adcc4bc19f508b03893e728da1fa31adfbbd34f70d7e3faed38709826c70d2703148f25de50c829e831d66cf52a0cb535103aff15386e90503d6
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5f88c27fa56e217699c56f3ccd3c31aa2
SHA12ca9652af2b1d5538edb5917396c1d800e37d6ac
SHA256fc94f3d9fb7ec47104063c3db2391f8c4d9bdf5349e062dab158e9c5cca6aa24
SHA51273f96979bc55d0fb461501fbf0990f32ecab2cce395fa5d2de5389acccc7f5d931e9c31d80a1aab5d87ed59cf8fec9ba21cac3c78d690ca77c38a9163289a558
-
Filesize
108KB
MD570ceb1e151d8fe514ab8c18c2316a6d4
SHA1eb1a37deaa980a5aa6dac8d155a6f34c82d95e90
SHA2563e4464296bb8f0b6dd75da475bb350baca99094eda82b48c10a54836b9841c9e
SHA512b006e97171f080d0cf9f5651f14c1e73d23acf81d83a6a8ee7c74a51bf039998839aad18f1de3ca31b78d48c82ce13b94e473397478903a53b986cf3a8922af3
-
Filesize
173KB
MD5c0e913bf952b1a92174c0b718c56c83e
SHA1e5aa3bb4d4951f1157a020a32c639fda4bb8dc6d
SHA256d8dea187e28b2b6147efed4c053659c60db2263d7f8a265dd3b80656cb90345d
SHA5126022db5f58579e017d5e426bc630c862046fedc0804a9628b2f321e6fa3909b8853210bbabbaad77a9a1c8dad5e10256e7bfc8f2b7988e89c3f01d812d5d306c
-
Filesize
1.5MB
MD5ce429d5112bbfbe40714ff3423558dc1
SHA17b9c7620419ef0764fea49c1c9a291a5c1bd897a
SHA2560022701526936a2eeb715d1cbf5dff70bb0828e341c9df0f239214b6d2ff2579
SHA51260871efc129bcc8089998364de047e00b8041f29022c04ea1ce57a149eaf4747738a26dd4d0dc3b1daa07333c964c9f2e267fd47ecf9766b61bc804185bacab0