Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
07-01-2025 22:13
General
-
Target
ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32.apk
-
Size
3.0MB
-
MD5
a3c3df62b04862454fa2cbb982c970ef
-
SHA1
71789c4596041d12429609ceae20c5e1cf255160
-
SHA256
ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32
-
SHA512
64c3ecefbda27c1fa79d1fbd0e317b256ff86219381e64c175db4d09f1de9a5b7fb5dcbf801e30cd237b0883515f2a114210e38296aad131ef7467e068f34506
-
SSDEEP
98304:5AiiQ3V2iLfDOegg4TdPuh/N+HtVFqqyB4CVZt0:Xiyhq+oNn
Malware Config
Extracted
ermac
http://194.33.191.252:3434
Extracted
hook
http://194.33.191.252:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pudewalamopa.yesiba1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5aa1f957041f47aa23179506673e493e0
SHA186c340693cb5d94ba8285f62053604909fd37b02
SHA2564fbaaa88e85a72a0050013d9200431c78b28b7de9a64421c4cf408d8cdd4fc8b
SHA5121c4b701e0c1926555496a63ce2781778bb61696b6c6fbf84ed4f28ef80683656c6473f2bdd62d2e6c2441afa4b2acc54237e4fec6ce876df62be0a3d92025a03
-
Filesize
675KB
MD5011dec3bec803341a063ed03f5036137
SHA1f1eab122789f4059f8b65db83c4602b3b3ca481a
SHA25639d1ded8ecdbd92bac4be34382fea8fc723872817bfe6d9c24645d572c5fcaa0
SHA512e39cc472581aa156ed57e59c47d9899f92ad9256e91c6e7f54bc18a14ba4a295fcf8b61de6d1896b2f53ccf07703a7ef400dcd86ec8651ec732ab2cd5f045b3d
-
Filesize
675KB
MD5fb152de28f5b856d545a63ceb04d699b
SHA1fffbf8e3b9595bf8b0b2867103530fe02c73c3cc
SHA2566affe13cb81ac771ad2bf9b0cf6ebf229e3a1033a84a23fd3b78256c296025fc
SHA5127bda40036e3054c1473299898f026a94740b50d4a422181eed1f545d313722391057111120db889d373a4d36af23283fa06fa840a06ff83b92c1df74819094c6
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5fbf04386549f182088fc4a7f1aa866db
SHA17106a4e76d4d8cf2a25b8dc3412ff3a5b95b5dca
SHA256dbb1302203c94d71cefcc55cf9f6851051166635d17ae6a7d2791a54630a1da1
SHA512c1f467043f2e673a31ca64c36244219d3bc63c93a92733b98875f69ebadb67c422ccb4a5e5de474fbcb5f964dba861ed9f1301f61ff367a132faee7a7ffbdb12
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD56f92964c5ba0dce8d1ea545bb0b3461a
SHA112ab2bd237e80feca69e55211eec7c1bee229470
SHA25675c92be229477749d161e252f65fb96d6d2584b1144d92b59a59fbbd8e933f5d
SHA512b86222d4e5633c66060814d5ae79b82ce69829a6b672fcd6bbd45f25f4ee8a0d0cecfc4c752ac4c8c3350e8d21c399070c7cb329cc7053df7fa9671f92a3aa25
-
Filesize
173KB
MD521644d227abcad9a46f6aa4271b7e1c8
SHA182aa31308497889eb702b78947d0d7580d18d90d
SHA2566944cb4eeda3bdf5735b7701918e82b7dab1ca119f56da50081c6a96bb40d426
SHA512fcf501cb67f3d4a6343866577d6f929dcb2ab07023441b9883a580d4ea27fb60388dd5dc79d82001d0fb73936e133fd100e2a2ce7379cf07a3eba7927e1b6210
-
Filesize
16KB
MD5b97c7b2da5259d73085f953e231c71ba
SHA1b07d83d2c9d01e8dc8b8e728b4f98ba13af658e4
SHA256c30d191526ea614f3e51520212638b1d9f365bf4156c880528f42ff09b634897
SHA5123501992035edca507d43e5a29b803c1a8807068e11a546518139943fd5e51b0adee25d01ed32df247a1d2cdecb47fe05b5c6f53ea439b8bf07fb34108095f3b9
-
Filesize
1.5MB
MD5bfcb0472637aa44e8dbe366cfee28beb
SHA1ba403155e2aad7a91a0bda471b87fb23da2862f5
SHA256fa126c6ac279aaa1f3144d0ad088dad3f5859bf6cd5c34eba4cb5a0b592cc1a5
SHA5123a815b3dfa1f5ce35d347673f902ef1e557c4ea4e2d2cae8940757539c868d3cf82475fa1c09782861b1f62c6021e3971a12c240845e86dfee836c9ca3dafac2