Overview

overview

10

Static

static

6

fa38e83fb3...6f.apk

android-9-x86

10

fa38e83fb3...6f.apk

android-10-x64

10

fa38e83fb3...6f.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    14-01-2025 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa38e83fb3671a46a81588270447804d6b6fd582f1097bcb83403f48a92d3c6f.apk

  • Size

    2.9MB

  • MD5

    264b546ecd0f21514fcd34034d20b375

  • SHA1

    cea0b5218d3b0c513c726a5754f20b3aa3b56b06

  • SHA256

    fa38e83fb3671a46a81588270447804d6b6fd582f1097bcb83403f48a92d3c6f

  • SHA512

    0b1fd6d9fb4bf8d6b61b0ed9694951361f17f33868cda7867fd48b680c413d30e864152fbfb7b85d0a85ab1223ed02152dd42fbc01cf1d03e6ebeb31db586480

  • SSDEEP

    49152:HqQ58MSL+3bIOpdziY81Wuz9rg7FO0tMZ39KhKDuTrsEhtuS3Rqjnq4VPn7ZqC/7:HFyMSLKIe2Y+7zErotUTrHtvRq+gv9qQ

Score
10/10
ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://154.216.18.137

AES_key

Extracted

Family

hook

C2

http://154.216.18.137

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 1 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
    collectioncredential_access
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.kaskasaslkasata.kuri
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4629

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Access Notifications

1
T1517

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Access Notifications

1
T1517

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.kaskasaslkasata.kuri/app_slot/SKja.json
    Filesize

    736KB

    MD5

    737752da762d9de1a28e32fc49eb72e3

    SHA1

    b2739d2102efa1f401547f0d31689c4b695fbe27

    SHA256

    3030081646124dc970f08fd8f031a4359e269657a16d579767a0421b7d64e3e3

    SHA512

    c00ce61d21ed5d7c3eef1240c3cd940abd028642f02b7898ceb07070749d1f59d39817f4033e3c65128174deadfbb243210ceca4a87e985ac50597d3bda69123

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/app_slot/SKja.json
    Filesize

    736KB

    MD5

    35dbd4d4bc1fd290aebb6b5339b62487

    SHA1

    5c7178af333481216f99ac3178b09586d4f37d18

    SHA256

    d3353684d46a65480b82ddc53b9653015d6cd5cef0d07980c056d253b674e88e

    SHA512

    107d043547cc0076a3956f85c4ce994122f677a7b60e4a0294e77d0fb48ea5d158dc557de9c870c4ebc8f93ffbcbbf5e23e8b9eded18db49d32e4e9b3b0cbb10

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/app_slot/oat/SKja.json.cur.prof
    Filesize

    3KB

    MD5

    bf49b68a9199e432ddcda93c12c1475c

    SHA1

    8573ea74e67342b7cd07e10055215f10bc48c781

    SHA256

    a70d3f68b050e20bd37350a6a9feb1b91c5cbd238d45d109be92a46ac173e670

    SHA512

    97cd91d83bbdb68afbb477ff7fdb6fc5ab40bdfa39d9e134c48b7278514603281e3e39f14afd6d948b465b8872f62fec8f5d88076ebdce0b3fc1d570a0e3c927

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    fe1218b450afd3c553c848a0a5cce587

    SHA1

    18c51b94ba74b995f7a45846312e9b27b7277190

    SHA256

    30459ba9e3ad21baec30a1487491514d3ea7cc15943cf1ba48d2121a3578c1f1

    SHA512

    67e324958808fc4a39ae1c7101e4b4695398b4475fa975d94e3d2053485c9ae565a41423ef0ab87129c8c2d71bdd7ab1b721e21329c142fd7b65de89aebf293d

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    a96d07824aeb73f23a0d7deab06e9c98

    SHA1

    45347dda19520a109e7156c07cf3e6f77f76fe47

    SHA256

    dc4ca470c54eed971f796c8baf39c73d495965ba6f18acd9c693415b37554d7e

    SHA512

    720543b14b1b0a9de8c9b4b42b0029c95aae84a9e9c9140aae217f1942e5c10e8c702be80a9d685c94f716c5e3a76401dfd6d3cc937307eebc893333969622ba

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    2d262dac4854389c19483fd5a1f874a0

    SHA1

    214002309463526fe117361932d8287a518a89ae

    SHA256

    12345446631fb4082d465e66ef3b471ffda37592713daa9b91172084994af93b

    SHA512

    15d129a5e6f76b8c13d8d8ff17b64c79703ce95d9b416bdb399eae4d22735e3cdee4b2e9ea839204d756ad2f0ac85ed2b132f29c4f0b8545714b0d5f0238fc8f

    Download Submit

  • /data/data/com.kaskasaslkasata.kuri/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    e40d5c611873f637bcbf5fbf7f9e506c

    SHA1

    06607d69d85e4803b77afc37b6a73c87dfd0b6f6

    SHA256

    ad41e2559fe8d7ae79df01e4557d2fac73e6a7b380984c1a01c7b5627880e7e6

    SHA512

    765b4d211ff43545eaad1ba4bef0e7c3c4664d76effa2fc486df8bf1215cd14cbf8a5f546658a4c0cae0c37f8b8af6754e1805296626c49b5998d622f6428b0b

    Download Submit

  • /data/user/0/com.kaskasaslkasata.kuri/app_slot/SKja.json
    Filesize

    1.7MB

    MD5

    b5a1aeefd71d8cbb9e33d373af5d291e

    SHA1

    d04776acf6adf304decd51d472ea7dbd5b3e0a43

    SHA256

    ebb2421d9052850293657f1560435e18d2a8c6e454ed72483f67b2f9f86d132b

    SHA512

    235301dd4ed83564bf233257f1acbf254d27ffd535cc08fc31866cd8cbfee70328215057848fc8ed59d28a0cf6b4220e00ada08b620bba159cff35441ad78d4e

    Download Submit