Analysis
-
max time kernel
149s -
max time network
156s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
14-01-2025 22:07
General
-
Target
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f.apk
-
Size
3.4MB
-
MD5
d21026b259a4da55a857bcdd8f0ad9a8
-
SHA1
9eadfba2c94f87656115a7ecc79d7b953aeb6676
-
SHA256
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f
-
SHA512
b6297e9e1ac87f5f593bcd3c32ffedad4d8aec11022a44dea5d876e7e1f5995700147b68d556078b26e1dd604bb9b5450ec82adf468093dc98c418aba66c7e48
-
SSDEEP
98304:B0MsnL1CI4c+gi1HQgnpVTfpqoiPAhYxSvO6k9NHs3AY+S:qvi1wgjB2AC6k97S
Malware Config
Extracted
ermac
http://154.216.17.69
Extracted
hook
http://154.216.17.69
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 2 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.corgiasl.kuri1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.corgiasl.kuri/app_arena/ACjXkWg.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.corgiasl.kuri/app_arena/oat/x86/ACjXkWg.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Access Notifications
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD57401265df16a0b12a4f00ce6ff635bdc
SHA17e593585d33eb07e9f0114cd43807e84c71e79ab
SHA256f9e63ce5024bba144d6cf860423cdb04b303b33d877419d5ba0e1f627b98c786
SHA512faece06d0b91f0b3c1d7968121bdbde22d95fb534693264fde90ae88ea000c7822a47ec8538793047504745a9eb20f0bb26faece5f0f7a667f3d3bc9d2c639eb
-
Filesize
735KB
MD500b78624da3d260e0c12d827fd4c2ad8
SHA1616e9c5114be4e7991e89bfd48b3273d4c0eeeaf
SHA25658da5d0c01e85f81390cd9c81befe2c46c23196fdfe3a93c27d959acbd6e5c27
SHA512a32b869018a132cfb5110756ad3c45daf8b822242c8d7781f5e6a70448a7f714cde55d6e8adb7e9020f67550258ff60dc1eddb02e4fe2d0a57d254b077454a2f
-
Filesize
3KB
MD5f9becddadeb11e707068cc353d5a2c4b
SHA174b1952e9c2db7a9ac29c9c17a2df499429bf37f
SHA2568dfe54c87bca5d42a851e8f0fc78a3bf277ed137addd921e04acd7ad05930f14
SHA51281b5d7af525e138590cd21055020e817b84aba6992e35a4dc4ea173de636757ee4a7f8d2e4236d678ab9d613c16eb792a0218e7d4fe4037ada8d0eb244304810
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD535e331b215114bed13ff3c537abfb872
SHA1c8a39a6e8bf4ce34d5e5e701860d9b8d9daed4e7
SHA256b256bc8d25d86e939e5f7d3d2da0e6ec26c4956798c649025268c6512142c125
SHA512046ae3118f18853794a8d1cb31fde01a65ceed3467d29b78f28dec095f1492f84a92a5b8b231887aad168ba34bf5a794e765121153e7c55456aaec4c39415ea9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD580438080d3ad78644838da319fe3bc06
SHA146a251635655d7e349f02a95ae75b6a4d6bd4428
SHA2560f0806ac9b26c570814db927f4f48af07d8bf5d18130de9a5514dee1bf0af75c
SHA5120981825987a4ea5659e00c3dee2d84d46e655d7c5473b9ac83cf149e78c1e8ecf1be64c8f3c0e79ff336bc1c1a7c4343a6ffc1aef654cf568c7616e0a4c9d04b
-
Filesize
173KB
MD5f5776a4af9ee4bf890ed220b004fd515
SHA1be669402cda70682dcd4f80a013c8bf3c35198ee
SHA256e3301f033c183e3bb07aee9243e80dec2059a71b3d28e116f393527ad1edda7f
SHA5123b76b6ac66a4e5bcd11d34d2fd753c06db54a6156b0945387b121d88d40f93fb264ee77ef3666fd32d2f7830deebe6cc8fd4b9c9d0188493721de61d4da70cb4
-
Filesize
16KB
MD569347c49c41a6362bc828c8bdff107fb
SHA171237c47d3e607e463a1b3aebf0ff2051d6e3c74
SHA25678a5705fa30ee6f4ca3bf344a1fd903345dba942f9ba53bc662ed9344bc5c9a9
SHA5125ff2be668c67a4e0f0bc5b7fdbe58b9f8688f518f2c87a19b1fdd9f3d6c77b7091b210f393487a1766136bd29f061476c2fd05ab513e17defa6a3e466fa3a1ec
-
Filesize
1.7MB
MD5d78532efc383f77c6072e8c24aa6b95e
SHA1687f6295c5a00c6bec576bf6d2edd4150dc62731
SHA256ac295de898e5b7e3f005e98136b09b189295b70126bab62a44bf4a040c2c117c
SHA512eb5855fb0621543832d86cd8812252414d5cbbdb1325709e8425d4fd27ee78bc5718a6a782c2c9ed0b740061e21abedfdf4cac0aae8eeeea09b27190115712a3
-
Filesize
1.7MB
MD57f4530adbbe5b099955c9544f2d81d30
SHA16abdde833c65da53568826db552ee0f32297acf0
SHA25697f5be3b035814a3fc4e15fe9b64ac255df0a144770f3dfca96862279a70a878
SHA5126e9c64f391e3748c0cb3640bd5a4ddd08e6858d721e8e47b2958f64c12157346ca372b93e890da01717a033c9c58bd29b4eab3808953b73df11caad49609f650