Analysis
-
max time kernel
148s -
max time network
159s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
14-01-2025 22:01
General
-
Target
b39066b6ef956b773733e3441485e2e3a6b412251a33113bf7f29de7f010d3c9.apk
-
Size
3.9MB
-
MD5
bd281af4799e607361972e7db41aeb84
-
SHA1
0fbfd66b84bef8c44f8cc1eb222ce39b40f5e9aa
-
SHA256
b39066b6ef956b773733e3441485e2e3a6b412251a33113bf7f29de7f010d3c9
-
SHA512
86f1fe505b00fdb2c8a14addbb98159eb5c980d7a81036c7d017573465eab5a425da25718d4403d0118ad726640021e947044eb5f99155a0b1dad1b3a95da887
-
SSDEEP
98304:9L2WOfKPr7DNEj05LKba0ySreQY6V4FlX8ExdXRElQaqv:oWOoDNEjoLgCQb4oExlREcv
Malware Config
Extracted
ermac
http://154.216.18.137
Extracted
hook
http://154.216.18.137
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 8 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.zkasaslkasata.kuri1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
MD55d672c08aad79b225d9e420bf4089408
SHA18c9d7e9e94c8866dd2df48123ed223c59f615188
SHA256af8d3366a547d8fdabd01b98da0c947b8477aa81f85e3c1672303a3f5064b29e
SHA512c31d09e892ae0a1bf3d1bd903648f773607fe163b8ee386c11e4b5516c68db747f4d7ad91bba17443b446589c4b70db62e1079afca5badbc3f63968dcd8d6c4b
-
Filesize
736KB
MD59aa5cea33b9868b1a19149a4f89be59d
SHA132b040b6f045c127da1ae04dc33737914cb6e01f
SHA256e1df0b98068001a3532efca304f30e272c9f4661bc62e5ec952b1399ddbd639b
SHA512d81e4943c13ff2bb484b297ac35e2fd20b6fbfd8d49c649c6ffea8574316abf626316a18793e196f2c785bbdd4fd01f11fab828caeae0611247bcbb39d75dc96
-
Filesize
3KB
MD54417b356794f074f4cb0b44c3e65fb11
SHA15d9ae8b3b2d2ddb6f9aab758b9b3ace1515807e9
SHA2565c204a93b748d1a0fb1303e22cf0cd88ae476ecc8f43db6b36bac2cea53339ee
SHA51289cfc3503e07bcc5a58330403e1f42fc8478d975bcc0571727ae372842324508346de1690020f4cefeceaf4ee04ed7e7cf52d8bca441b225b5e7e18b555156a9
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD508c912bce2096a81b3b96a65962784f2
SHA199f5d605b7d0e6db6ecb30b945f06352e71cf572
SHA256afac09198dba84f289830fb225c22c29627903fc4ca2511680ab09d0ddede68c
SHA512b1787055ddde445c4933609d6b464db6d8dacc8b323c2446e83b3e701144d04e17e29a5d9de74545f9c8b7121f2e68dc59299c6590d8efb4fce0aea052acb990
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD57c09b505e94914ba92659ba38de12dfd
SHA171133a3d5ea8907a08b724ac24280addc9f3c7b1
SHA256808b99ce411c88ed395d821eec11d30372ba934aa38c8d7cd03d64554c1e61dc
SHA512aa32ed3594b50ff854845e2bd25136fbb0d8b720eee471457698f9b1ae474392f368366ae865960d6337f60ded48329fcc18397ad1c913555500c31d6965831a
-
Filesize
108KB
MD53e744567fd7ae2d23f75d25dbf5aa0cc
SHA159b54672c24a8c916cbd6e453e30359ec1810155
SHA25656365db9da82f2fb5975ca3628275d15487a9e1a03d9e84a13b4a913eecd355d
SHA512c08f39dc77bdbed559c4b0fd51969732c378b91298c1f2ad14218e34667265314f0ba205dc0825ea745f5fdee65a6b6c1c0df622130fabeb75b71aea7d094e47
-
Filesize
173KB
MD5b02151a01632e86a2604c9840bb22a70
SHA13268327c706bdf628f89c39f365dc1efa35ce465
SHA2567db164dffd053d686f1240e24c92531db6c7ba5ffcaec9b246e44a866620dc27
SHA51288fad471508ab5d3c72cde0354b3d90cdb20033cc6ce44c10a70bc9be1c3a70a8ccbea26529bc3e18c2fda01976d603dcfe805476832ad410405cd11573e35d9
-
Filesize
1.7MB
MD540a20d8c23e21773552ed5f59ecb321f
SHA14823c1f50540d987bd530b729f908fbefce04def
SHA256b5c5ef231d9a03d37e7c9b99e2796734f072cc085b117f4e424c9583db02dc01
SHA5125e4634b040c5989763fce4f9e8776d19687f0dd2a169cbbc13ef4ae4563aba1a1fcb19b22486814bf3d220eb87db7c5437433a2fd3310b5378d804b4fe5f3570