Overview

overview

10

Static

static

6

dbb5b90f27...d2.apk

android-9-x86

10

dbb5b90f27...d2.apk

android-10-x64

10

dbb5b90f27...d2.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06-01-2025 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dbb5b90f27222070018a8e029422643a6eb61bf4de0b9855f4af25e0947a07d2.apk

  • Size

    3.0MB

  • MD5

    27c3e47e5c404b472c332e84aeb7cb0e

  • SHA1

    e335dd6e432907c95b05ad85f117f3cf0f22e2e5

  • SHA256

    dbb5b90f27222070018a8e029422643a6eb61bf4de0b9855f4af25e0947a07d2

  • SHA512

    e871a8171603b3dc4066d7b2f3582fe8a3c14dd3e0c46027c45545eaa3f819d42e7330a8b05e3d5286545a44368c2b81d8a9138452c11a64732e0e27d7e710ad

  • SSDEEP

    98304:qzT914BLyLfD8b2g8kdPO3N+oEiXDtpyB4CV1GF:mJibs5YgH

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://85.209.176.208:3434

AES_key

Extracted

Family

hook

C2

http://85.209.176.208:3434

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.xuzewavuhahi.xomi
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4262
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xuzewavuhahi.xomi/app_DynamicOptDex/Ky.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xuzewavuhahi.xomi/app_DynamicOptDex/oat/x86/Ky.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4287

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xuzewavuhahi.xomi/app_DynamicOptDex/Ky.json
    Filesize

    687KB

    MD5

    271a83491c28ee7f01b49d1b8c3ac48b

    SHA1

    283cd5e7685a48a52f6ca0d0775964145d2345f9

    SHA256

    625c9e5cb10250ac8c591ad7b9c8700af064a0a597593720dc9a520878bd01e7

    SHA512

    07824035e500dfd8df43755c542fb6b068ca496b0dc5b8e839320dd3853bc97b4b0af4b642c34b7364db54fa84d97713b9f33b9dc5c4d66777c868d39acefefe

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/app_DynamicOptDex/Ky.json
    Filesize

    687KB

    MD5

    ec6b9d8e16ad00340b578dbfe5f1dc6e

    SHA1

    030ebabcc90f78ebff9f87c3b6cfa348a50335e2

    SHA256

    a4725bfb6d51e2e5bae521b55e1c8c74eef85d6b3ef7a38108a7f77f125f6bc9

    SHA512

    c7d648061a26cc8236cff5faf8a828cbf4721ba948a79659cda5290bd2ca47673f0158b81461e91ccc7fa4c5b18c2c22acb51db5645acbe1803d827e51794933

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/app_DynamicOptDex/oat/Ky.json.cur.prof
    Filesize

    2KB

    MD5

    0502a000440c7d2193f33cfe2d00f622

    SHA1

    1d3e8acfc0bb23c448c6a62bf479472b3d6cd9f3

    SHA256

    4506e736b36d94f99709ae95e65f4de8707534c404c76ca83949ea484cbad6fc

    SHA512

    fbe15f9769ce89f39ba43dae82caca20befeb502f60c824d099699331463ffbfef83bf5742bfaf4ff00cc3055d51fa7fa346d54878199a27271544b23f923597

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    f58913119cf7926092f3c700d872ba20

    SHA1

    b58ac12557122ae1d2899140be0f6b96a473af87

    SHA256

    d562fab5bb405496e6b49fa1c287d2bb943e521c4abbb7eb721c7520d3ad8d14

    SHA512

    08727cf1ff6ff207904c69b85320992743234b8c1905de5c7cfba6fc2fb9bf7e06ac7e4b670870b5e3589fe12c349d13aee9ece740aaadd5687c632d55d58715

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    90cbfffb8e0c46afeb698474f4a76584

    SHA1

    9a56202cddc83655e89a17127023df076cc361f6

    SHA256

    fd8cded3f09a7aa2998b28a1c6f2401474249065560edb593dfeaa0ca9a7a226

    SHA512

    7da6f7427c27a9d4b055f97187d169b9c8351d990f1c5a2d1123dc5079841b76079933ee145997f8ee606fc81a6bf7dff9942a92b0019310da3026c074938cb5

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    c91258b442a314511937a258e71d1355

    SHA1

    844224eb169ef16464339a99c57887484516a3ba

    SHA256

    84e3fda57cb09dca4a9d8f9b6e5f459324916a575ad420dd154e40b2f355b507

    SHA512

    e4c43bac2888301178956a3c37499865a6271cb79bb3e6c1000968c663e8dc0832ce5093fb8e94c02933539f8c428e42ceea76ec6b027d60d8b3934bbcbab09b

    Download Submit

  • /data/data/com.xuzewavuhahi.xomi/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    7edc9d84801047eb40e9c26d4784d558

    SHA1

    dc71f69228b36fb3c2f6ccc571975f6d384d7cbb

    SHA256

    9e6f64cafd68df05822690c7800604e08266e97b4b8360d90ee054f1fb50bde7

    SHA512

    7b8300fcc29de42a63f389bc0791a895f4313e4114efa746f5630264953b964f5f9c101e6db9833b19873f6fc93f0c3a8bad1f1ad08349e64e186c2f6c75bd6e

    Download Submit

  • /data/user/0/com.xuzewavuhahi.xomi/app_DynamicOptDex/Ky.json
    Filesize

    1.5MB

    MD5

    7f4b78e311c76ecb366516b430f3188c

    SHA1

    3187a5cdf64287dc3094c690e58fd53fe229175d

    SHA256

    2e63aeb6dbd39aaf720dfec6e7dab8920e39ea316293285ef3d515e7163975a6

    SHA512

    aa23a04c6ccc6d8d4d59377935fb3dd21b0a0a3c02b59cc339baf22d6670958060f3c152fa2aab1b40577addfa1a16f3fee694a333f1f1e0a1b037fedd2fe1e0

    Download Submit

  • /data/user/0/com.xuzewavuhahi.xomi/app_DynamicOptDex/Ky.json
    Filesize

    1.5MB

    MD5

    e473f94a807afbcadec69f9a7d0b0eb0

    SHA1

    be5d9637420e2ed44b63443ee43ac5e1863beb42

    SHA256

    f8432dd80ec113fd2bb3a8e17441bd012910b4bfbbb6b06c8306571f16b030b0

    SHA512

    98311a4cf40cab144840fb924804fffd1b8d76bbd69eaea7aa0746ed86e8aff096efde5793a15a25fb127cf53d2f24af16baec88bb7c0937d2dfab0eea581fed

    Download Submit