Overview

overview

10

Static

static

6

0ab241d644...13.apk

android-9-x86

10

0ab241d644...13.apk

android-13-x64

10

Resubmissions

11-01-2025 15:43

250111-s6cpdssnht 10

11-01-2025 12:22

250111-pjx52a1qdn 10

10-01-2025 22:05

250110-1zngbaslfp 10

Analysis

  • max time kernel
    52s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    10-01-2025 22:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ab241d6445921cda7e297e2ff2d4bda7faac91e2bd7af50e2459b5bd77ae813.apk

  • Size

    1.4MB

  • MD5

    8483db09f538d6728f8b81ef87cec401

  • SHA1

    b7e85b13461cfd647e3f33f38693ac33079d0619

  • SHA256

    0ab241d6445921cda7e297e2ff2d4bda7faac91e2bd7af50e2459b5bd77ae813

  • SHA512

    024ac52d6d2f0ad23ae7bd2b4d06acec24bc545e57391b939b12833b4df33509a1bf736341f37a7e0c21847788513011b1ad1d195f4fc28db707a42cfee93e6d

  • SSDEEP

    24576:gg/B9YJgCe8R2PtRrRDZ7nQXjp+UMZCayqoonZLiF8LjxejwUVAUf:gg/wJ9e8cPtRrtZ7m8UMZC5qHZLUf

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 1 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.herunawumepa.kapacagi
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4215

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.herunawumepa.kapacagi/files/arm/classes.dex
    Filesize

    1.5MB

    MD5

    49e3ca3665ae59ba0e3bba4c7c8c9f80

    SHA1

    de0d782e3a6db0341237221d6317d09cf4f489f1

    SHA256

    a2494475153cfc6d387be48078bb4a5960d5619fd47dcbfead44d8d9ffd0c42d

    SHA512

    07d1663836799eac04b789529f0111da35647d72afb597a7280c5821ff0167f99ba889ccf190d20f0392ed76bb7866ca2f1f8981a3842399cd0582ee4c4ce953

    Download Submit

  • /data/data/com.herunawumepa.kapacagi/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.herunawumepa.kapacagi/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    f17a9b865f5500eab80b7e3446261986

    SHA1

    2fac7126b7e21f861484abaa60ff2654bd302d6b

    SHA256

    4e5c674b25e22b172402c2cab4b38abb7cb993e58fc03bcd3993c5c0a9e5dc83

    SHA512

    ede76ed72cf7e8605a90ac343becbfd3978059b0cbf80f1c951600bc13020caceb664726262b85f1d5853f16dcf58cd93c419093a78a0fd4423b13c7f37f99b2

    Download Submit

  • /data/data/com.herunawumepa.kapacagi/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.herunawumepa.kapacagi/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    cb06266eead3a74fde4b603f4e281119

    SHA1

    f2dc1d7d0ded2a50f8f1269d4d2413e0bf685ee7

    SHA256

    86706453bcc7957f86875d95f5ffef5d88b77e19fb06c0b2b0668f05245a8412

    SHA512

    26b45dc6eccaee4e1c017b7b2dddf059d7aa3785d4cb4f45ab9e681e57c8871014d0f0087cb8d74baf70463bc345ab8d97302167793fec14d233846d9e8a6f34

    Download Submit

  • /data/data/com.herunawumepa.kapacagi/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    b0bd63a4012969055bef7c4d02813543

    SHA1

    b5db17ad66017b3793de166435356563538b0160

    SHA256

    63d98418d09f7b2e79146f99891d2cb94a849cf3c6261093cab6b774c222efe9

    SHA512

    f855bf5b8f85e6ffc5b5d7702a3693ed517df305b6141456eaf43e7a95281f40a3a0fa5e14dba8de873e6831402b255193f58705970dd82ea7c47182dab18314

    Download Submit

  • /data/data/com.herunawumepa.kapacagi/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    0b9d8286bce97c4b395ff497819a3ae0

    SHA1

    cf089c06dad98f25959e617e660f158a0c73b2e1

    SHA256

    b95283823a89c516acf1bda41ae1b1c30a6b8d4fcfb19008ba92f4b55df52f60

    SHA512

    5808491e146a281cf9e40fe82ba8700be13ce0e67a911023069cfa5bc732a22fd1c3cfbf390107ef99670af4f9932ee9cd77450782adbdfba2b03b3354190a07

    Download Submit