Analysis
-
max time kernel
41s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
14-01-2025 22:07
Static task
static1
Behavioral task
behavioral1
Sample
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f.apk
-
Size
3.4MB
-
MD5
d21026b259a4da55a857bcdd8f0ad9a8
-
SHA1
9eadfba2c94f87656115a7ecc79d7b953aeb6676
-
SHA256
e58f1c087f1cb3379c862886dcd61428daba19350b7bed5aba4bf495983e073f
-
SHA512
b6297e9e1ac87f5f593bcd3c32ffedad4d8aec11022a44dea5d876e7e1f5995700147b68d556078b26e1dd604bb9b5450ec82adf468093dc98c418aba66c7e48
-
SSDEEP
98304:B0MsnL1CI4c+gi1HQgnpVTfpqoiPAhYxSvO6k9NHs3AY+S:qvi1wgjB2AC6k97S
Malware Config
Extracted
ermac
http://154.216.17.69
Extracted
hook
http://154.216.17.69
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral2/memory/4926-0.dex family_ermac2 -
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.corgiasl.kuri/app_arena/ACjXkWg.json 4926 com.corgiasl.kuri -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.corgiasl.kuri Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.corgiasl.kuri Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.corgiasl.kuri -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.corgiasl.kuri -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.corgiasl.kuri -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.corgiasl.kuri -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.corgiasl.kuri -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.corgiasl.kuri android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.corgiasl.kuri android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.corgiasl.kuri android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.corgiasl.kuri android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.corgiasl.kuri -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.corgiasl.kuri -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.corgiasl.kuri -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.corgiasl.kuri -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.corgiasl.kuri -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.corgiasl.kuri -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.corgiasl.kuri -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.corgiasl.kuri
Processes
-
com.corgiasl.kuri1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4926
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD57401265df16a0b12a4f00ce6ff635bdc
SHA17e593585d33eb07e9f0114cd43807e84c71e79ab
SHA256f9e63ce5024bba144d6cf860423cdb04b303b33d877419d5ba0e1f627b98c786
SHA512faece06d0b91f0b3c1d7968121bdbde22d95fb534693264fde90ae88ea000c7822a47ec8538793047504745a9eb20f0bb26faece5f0f7a667f3d3bc9d2c639eb
-
Filesize
735KB
MD500b78624da3d260e0c12d827fd4c2ad8
SHA1616e9c5114be4e7991e89bfd48b3273d4c0eeeaf
SHA25658da5d0c01e85f81390cd9c81befe2c46c23196fdfe3a93c27d959acbd6e5c27
SHA512a32b869018a132cfb5110756ad3c45daf8b822242c8d7781f5e6a70448a7f714cde55d6e8adb7e9020f67550258ff60dc1eddb02e4fe2d0a57d254b077454a2f
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51ce1e720e81af1f29ebb220dbdf00d5a
SHA125355358cd55a930474b4ee74461eb2af0ad50ce
SHA2568b16eb112f7ee4565a2347293987343e0b667ef66b0a4e1d1132b2c40b8853e6
SHA5129ecc7c4cb2a9edf602f9eadcc38ff63a5b77a80f2b765e3c94392ad58be8e385cf9252e68a3590f43506a0c331a95919d3144fe008fe4f9e9544ed59adefcb91
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD58a940f1d05cae0f7b3f31d78832ea5b4
SHA10b84a3e46a56828435c415b863235cb6b637a3cd
SHA256f20682a90d9a90529fb1e38eabfe07468491bb380beca214739e38a7917cc6c3
SHA512cb2fd980359520fdaf69bea8a95526b7372b9caae585a6f9683370c480897e048c1988cd337d1b6f3c7ba5d19eb4527942f9e4f8c4ed10548bb2e16558997476
-
Filesize
108KB
MD56b4d14c64362162e5b0a0b19bd4f1629
SHA14c542b0d757d36236f13e5dfdbec92494b9d73a9
SHA256c79dd4650714fe76d1d16dccb204bc298f7adf5ae02bd69e4c56adbbbfdaa54e
SHA512d897692d3cf0870f0dc15f669c40ad9f3fb3ef806ecabea670b9b2ce17e70df00ad2e358e79bc79dd662751ad719bb1af909438475f4fd88f8a743231aab42e5
-
Filesize
173KB
MD557f73cfd6e4339bb6c93f1a0aea4746e
SHA1d491ec7a146a87c3f4f77c6a06021f253c1e1f51
SHA256ffa2310ae80e6c0f19febebe87fc59ff7ab4202e89847ca511eec5409f403f81
SHA512275ae92b17d2499140df16ce5f5f875af095d16000cd4546a6d99c0f997b8663632722ddeb90e490d466e682b10f51bb296e5c1838ae227982687c89276a51da
-
Filesize
1.7MB
MD57f4530adbbe5b099955c9544f2d81d30
SHA16abdde833c65da53568826db552ee0f32297acf0
SHA25697f5be3b035814a3fc4e15fe9b64ac255df0a144770f3dfca96862279a70a878
SHA5126e9c64f391e3748c0cb3640bd5a4ddd08e6858d721e8e47b2958f64c12157346ca372b93e890da01717a033c9c58bd29b4eab3808953b73df11caad49609f650