Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
07-01-2025 22:13
General
-
Target
ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32.apk
-
Size
3.0MB
-
MD5
a3c3df62b04862454fa2cbb982c970ef
-
SHA1
71789c4596041d12429609ceae20c5e1cf255160
-
SHA256
ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32
-
SHA512
64c3ecefbda27c1fa79d1fbd0e317b256ff86219381e64c175db4d09f1de9a5b7fb5dcbf801e30cd237b0883515f2a114210e38296aad131ef7467e068f34506
-
SSDEEP
98304:5AiiQ3V2iLfDOegg4TdPuh/N+HtVFqqyB4CVZt0:Xiyhq+oNn
Malware Config
Extracted
ermac
http://194.33.191.252:3434
Extracted
hook
http://194.33.191.252:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.pudewalamopa.yesiba1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55fd382b6486a51ddcfce555f75ff6c5f
SHA1c8a84b690daa1a92e77205ece9b303c5b3f80ccf
SHA2564f38417d797f95079adae1777ac1aac2d47889f6d034edf1932188943fa47f97
SHA51266213aeffe201f93f6c61dc3cc01e07db8c47cb606c5d8af080ca5b2f6c1e80ea55be55dbf4ad5234f52c28cc43512f3171a329273703424e9779d70847af3a4
-
Filesize
675KB
MD5011dec3bec803341a063ed03f5036137
SHA1f1eab122789f4059f8b65db83c4602b3b3ca481a
SHA25639d1ded8ecdbd92bac4be34382fea8fc723872817bfe6d9c24645d572c5fcaa0
SHA512e39cc472581aa156ed57e59c47d9899f92ad9256e91c6e7f54bc18a14ba4a295fcf8b61de6d1896b2f53ccf07703a7ef400dcd86ec8651ec732ab2cd5f045b3d
-
Filesize
675KB
MD5fb152de28f5b856d545a63ceb04d699b
SHA1fffbf8e3b9595bf8b0b2867103530fe02c73c3cc
SHA2566affe13cb81ac771ad2bf9b0cf6ebf229e3a1033a84a23fd3b78256c296025fc
SHA5127bda40036e3054c1473299898f026a94740b50d4a422181eed1f545d313722391057111120db889d373a4d36af23283fa06fa840a06ff83b92c1df74819094c6
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD57acb609a8f505738f5d177b17dbdbd48
SHA1c6b7ad1ceb8986386dee8266d777da437f98c60c
SHA25611bd5ca77f880d3e67b47d33653714595f763a9898f04c7d1a8b0a9b07bfa4a5
SHA512e051d24874eb5eedf9999f9fdf1d2827be2a1f3ea1d2221e63faffdc39c100f9a6de988e99c6ad053d0dd133ed4839baf2970a1238e89bd76393182098090d6c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5148b8524889007409efc05dd1462aea8
SHA1c7548ac9993a7715db0b67693aaf9f40171a26a1
SHA25613bb9a2a14ef815f1d780ec9d21437bac1fcc10c43eb6891d6c0d081c7218beb
SHA5126a944555d35d3069d0862c182848bd5ca29dcb82923b2c30ecb92f5153304701c6a30027f9fdd79a78b3fffcdfcceede9e9714d708ebc292e33b71d5fa834422
-
Filesize
108KB
MD533a41055b268a93f3dd1667eca552907
SHA1d609b995ed377dc1130199c7c674e65c9b66f29a
SHA2560498eb091cd809c29ec8ec460abacf3c36d8ebe20e93ec70c2b73153da08e843
SHA512e6aa09e4254a73e34e01e1e5f0d50919a907ee5a80948ef302860d8dbcf0295864edb2a84265f6a22ff90473b98937acccffed59b635e50527842570147e84d3
-
Filesize
173KB
MD5620aeeee8b38981c8af234e7eb1d37f1
SHA10f2ea95f3930984f2d203dae5c42ed605fdedbd1
SHA25600a221f88f6cb706c3f0763fa62f3f417834584dc2b3c37d073a65d702006108
SHA5126060862c5b0cb2d02dba8abc6baf93e210831c6fb6273006efc7300a994c2e214cd5e40336b92003f39b859cfd89edc17d8d3c93753cbb0ab98d340292621022
-
Filesize
1.5MB
MD5bfcb0472637aa44e8dbe366cfee28beb
SHA1ba403155e2aad7a91a0bda471b87fb23da2862f5
SHA256fa126c6ac279aaa1f3144d0ad088dad3f5859bf6cd5c34eba4cb5a0b592cc1a5
SHA5123a815b3dfa1f5ce35d347673f902ef1e557c4ea4e2d2cae8940757539c868d3cf82475fa1c09782861b1f62c6021e3971a12c240845e86dfee836c9ca3dafac2