Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
05/01/2025, 22:02
General
-
Target
595e4b0da43dcb9b349c506d6d3e9d1a3ac077992bd84e494d44100479c04386.apk
-
Size
3.0MB
-
MD5
6c43fb723bf1cd6b195fbc1395aa2dbd
-
SHA1
9a8e71e125cc5bf9a5b7f4e833a98d0a36ff7ee3
-
SHA256
595e4b0da43dcb9b349c506d6d3e9d1a3ac077992bd84e494d44100479c04386
-
SHA512
e2b0f26167709972aafb321beddcba09da4dff08afe9987ab72c8996c8a2adb17b1af1c9c3ca224dfaae9642083408bef4b58594f635115df8866e96e738b5aa
-
SSDEEP
98304:vSSizZkTHucoyLfDKsUg8ldPamyB4CVj2NBG2mXgmZD4R:6ZzYKnBZ
Malware Config
Extracted
ermac
http://194.33.191.251:3434
Extracted
hook
http://194.33.191.251:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cogubocubeka.vewo1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
687KB
MD5cf8f5e8d118274f56ba08ada133acd01
SHA15e9a5a5686e92bfebf8326a76911505072997784
SHA256f8f294f5a3c6ffe8ed1da078d07d3b1f13f7d78ecab081c29853058ae8fafa00
SHA512d47334fc5aac66c9fb745aea8960912fd5a6f05c7154f922a3746460e1806dfd424f7f788dfd68d8eb17c6e5202be0a97a5167de0012277dd7022f8541617075
-
Filesize
687KB
MD5925316fced47f2a806807e400f0845c8
SHA189ce8a88fe0d04baa0190e7614f961857b815371
SHA25613239f29648c9e04a8d2c16bad4d03ab37f9f87b2a574148f64734589bc5686f
SHA512606a1d6cb9642795ad248d7a7fa09b2ec46d571ce6481a9576f50db9344e0bf1c38160526539837c22e28525ee3ca8a02d22f0ff08d02c176394ae979986f95c
-
Filesize
1.5MB
MD5ce429d5112bbfbe40714ff3423558dc1
SHA17b9c7620419ef0764fea49c1c9a291a5c1bd897a
SHA2560022701526936a2eeb715d1cbf5dff70bb0828e341c9df0f239214b6d2ff2579
SHA51260871efc129bcc8089998364de047e00b8041f29022c04ea1ce57a149eaf4747738a26dd4d0dc3b1daa07333c964c9f2e267fd47ecf9766b61bc804185bacab0
-
Filesize
2KB
MD52f69e5f88b208e97e7e8a16bdd5b0b20
SHA1462f4d81bce7d2587312f7e55b8c0d9847e5ea2c
SHA25655b4b0ed97d6fc703512425913fa40bb7a76a4fe0498b34b347c6e6b1d001bfe
SHA512152c08b790166ebce6e4c331359fe18f885583fa5fd540e331120f2948fa99ae90eebd4a8fea4fde35d427864a25d9ec76d45e4bd6f17928a5fb754c77a918bb
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5f7d134c313ed333e3fce4c26a95ae2f4
SHA158a5024693893dfce8ff27ae15d94b0f488251e9
SHA2567edaf3d0d5391e1663ec8a01c72bd788b843b8013dc5f31d39538f7c3cc7ccdb
SHA5126ccaf26988fe727e9dfb382d2bb9f519e41dbdbfca36043c574d7af5084555806bb85c26d3d1eb7146ff2369767e142c5d9e4d625d14db7e33066a188eee3336
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c172f3d12f0b4c296c5027a73df0edc0
SHA1bd3d940dc8812d10eeeb6ce454ddcba248b1a843
SHA256a79fcaaca396b1cb2d8c6acd669c7ecc85bcdc435a9163d301a140327f16e3f8
SHA512d5e189189783806855735e2a8f0113a4cd374b6874b68134821111ea39ee7933b929c522c630daee264f41ac1c0a6d89c6da84a99996ca589ffad71531c70020
-
Filesize
108KB
MD5d828a04691b640e3cd7b3ec0a09d8e8c
SHA1ebc5354fff9c5cdc4aa0be7a2172f8e32504782d
SHA2569f706442367f0820059024329b3390fd774511ab6e92257b1f9390a4e0629500
SHA51229683dd498a3e94f1fd2a68b8031f6ca8e2cf328c0aa682214506d8863990faf96de224889f84a3d5a2e42218f8fc5193cfe19ab75be6dfcb8c6e068de9996a0
-
Filesize
173KB
MD5dc937d6b30e0481c3ec21c6065b4bd8b
SHA1757a4135c8377bfe7bace22310d56f661899598f
SHA25646c7136b1b9fb730f8c5a885b3be2f8d85e69cdab3b8b0a00e8dc85b87079caf
SHA512ddc6c6426424ad4be5f12bef5e1d8d5482b202a4264c7ab95630eb8b766413aa2d2ffab0e20b1c0f48551cd9f5ce89bdadd50a0b5936e119b4fea298d5945f35