Overview

overview

10

Static

static

6

3232a0480e...d5.apk

android-9-x86

10

3232a0480e...d5.apk

android-10-x64

10

3232a0480e...d5.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    25-01-2025 22:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3232a0480eee258c3a3ac761b91b6183c7411f2ddd8bc056b1fc535788048cd5.apk

  • Size

    3.2MB

  • MD5

    d69e6d0fa481ea70f6e8204a269ea61d

  • SHA1

    621bbab5eaf32a0af87e503dc97d2b023c71f350

  • SHA256

    3232a0480eee258c3a3ac761b91b6183c7411f2ddd8bc056b1fc535788048cd5

  • SHA512

    281c35474b2620101715d28629b79d048c257ff64575b7435c4adfdc15308231890a2826cf4d7c0c2cf891e9b54c79c964f14c3e45d073b2251791cb868f335b

  • SSDEEP

    98304:AqUJikGdB8LYOzUD8Hp/tYd8HD8CsTeAWigOm:AqUkkCAYOw4DY2HD8nTyn1

Score
10/10
ermachookbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

ermac

C2

http://hwng8dpx.pro

http://b7aae7vc.live

http://u4q9mbyk.pro

http://hcivp9p1.live

http://rzndg5cg.pro
AES_key

Extracted

Family

hook

C2

http://hwng8dpx.pro

http://b7aae7vc.live

http://u4q9mbyk.pro

http://hcivp9p1.live

http://rzndg5cg.pro
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Hook family
    hook
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.popevacedosukepu.boyeyu
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4257
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.popevacedosukepu.boyeyu/app_annual/alyqcc.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.popevacedosukepu.boyeyu/app_annual/oat/x86/alyqcc.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.popevacedosukepu.boyeyu/app_annual/alyqcc.json
    Filesize

    691KB

    MD5

    a9453a267e36959521456fcf6fa3fb80

    SHA1

    5ac05191c7af90495a83d860c9bfcbfa34885bfe

    SHA256

    5df85a6661649dc827f68b8efaa40f7fe19dc46a5fafa65e356ae3d26bb7df67

    SHA512

    960672b656f25ca821875be76ccd97fbe7d4e5041b4426b2d86f73d39b19080987efb854696ba15b9520edcb430c55377c1a18f531020ede2dc9a0358c0396fa

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/app_annual/alyqcc.json
    Filesize

    691KB

    MD5

    002d858cc3ba8005fb0e39de9a36d7d8

    SHA1

    8b3a668468ebc481c5681e410f6f542ba0fe04ce

    SHA256

    2ce810b12620a39e7a22c33b6fbad9d485af8b635c0f9f89919ab5f1035a87f2

    SHA512

    87fd12db2f256d162b426df59699f0d3b40d8638f982d246eeaf3489fc83c4fc849cece3e5b0852bc7d697ff3014c95e715e8aa3afe1d7c760437333c3c4537d

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/app_annual/oat/alyqcc.json.cur.prof
    Filesize

    2KB

    MD5

    926770562b08a3bc527602059baed6c2

    SHA1

    ad5590334cf509ad8f6a3cbd6bfef36039f2c35d

    SHA256

    32aeb8838aba4df183bd09ef9dba6c19e1854f8cadf1d7cb5e53e66de3f807c3

    SHA512

    bf0f2af694cfb2380029ba83cbce3f276e57ebcf4044d9e46d82fad08f62570862351547892f55240fd61a03ff1a437c3ab58f7b693f8846cbdebab492127745

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/app_annual/oat/alyqcc.json.cur.prof
    Filesize

    3KB

    MD5

    c575b73b25d10af91376b0722157df42

    SHA1

    42d40bfd69d2102f5e9e7b7661b9393aaf250c86

    SHA256

    9d4479e99f1b8ab82614a848f15dad52d72367a849eb445f3d46e04eee08dfb9

    SHA512

    1b4dc4c929183fc87c01a3fc545f0257ad6fe7af455f487b1d2c7fc06fa07449404c6dcc655c84396fb68147004b045ffee879026cb4629325b094e88bbcc3f6

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/app_annual/oat/alyqcc.json.cur.prof
    Filesize

    3KB

    MD5

    ebf59b41f6e3c7fa0e482b3d19376ba2

    SHA1

    84ca70c9795fbd031e3030a2d18ea9864d22b099

    SHA256

    6043c9b0493e4c789806fe114c276a805e1786d9a47665c6316e1d811aa2e21a

    SHA512

    7075f71b867052fcc5c10b2e6e4fd31732fa920388b1ec6aefad3d8806f20b983b298cdd3c126cbbacd3308bcb82a69e3b84700ed726b323e6fc55ef4db880b2

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    4054271526d52e5cf89b07afe9689164

    SHA1

    a17f5d1492d2b836ffc5c5c1590837f36d9be218

    SHA256

    7e1d7cd5fb30fb3101ec0ad84447bb2fe0cc1652741fa58a526211d707d8a736

    SHA512

    bd366516d30331e649704231af05f8168ea1b954813bf1dfdb779b456190d494c76031ffc73fbf613d174dd853a41445cd301dc73b742eaaa6f4878df3f4a4f8

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    c6d1517fa05d43234f7226961197535d

    SHA1

    8ccb69972c8542f6183cceb491a0e2ac7c2c01e4

    SHA256

    195ca29109595b1af658090f5704792bca84b5e2f2032411c6f20d3c5fdfa1ea

    SHA512

    7342dbc1fc205d035079784826392cf0f9d5903c49a62c52b363f41ae9dbdd6d49324b9297a2806d8fbe456b5b3fccfa3234df83f5b5e48845c364b340040eca

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    be2be9193c3c0b85b27ef83946e1f40c

    SHA1

    6a16eef9a76419bfa9b29150ad00c6940c0b7265

    SHA256

    a02059fddc4dc4e706d76c3a92462c0cb255932d4717e5706eac890aa7526d6c

    SHA512

    6c386c5fd620826aef5f1cad4c8f6875d1b953dec83cf1fc6aaba2c4e3fc5ec8651112b67bf234f48492e0532bc0060e75343e9709b2193666b4df0a183ffa89

    Download Submit

  • /data/data/com.popevacedosukepu.boyeyu/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    ba48e8a0691d845f70f6cc629df2a011

    SHA1

    8d48e24f536fe977388ed46d1516eea5a087afea

    SHA256

    8ec9f5ad47f195d83f986e6209c90ff27f9dcedd9d8026407e35758cbeb0aadc

    SHA512

    0856ca98075fc0b8f256850eef55b83554b27283fcb021defffe0c5a5588fb36d58193e9da13681b6703193ef32f714f4a4b68e5266e92c7717c0b7cfcfe1043

    Download Submit

  • /data/user/0/com.popevacedosukepu.boyeyu/app_annual/alyqcc.json
    Filesize

    1.5MB

    MD5

    5f12f8ed1229114ede390dff5f9b15f4

    SHA1

    183aee537550f18fe15b304f7cbd9d7ffabef4a6

    SHA256

    7353cd446d3a8bf92f829d35e0c6d610609cd4b0a1e6f5592bf6ae378eedb7ff

    SHA512

    c0f121b5eafb9ec779bb4461bf70816d662a9b8dbaabc771225dc38aeb6f84b5a282480190e82a9333a517175fca67a866baf595db33bef5cabc6920649cdbdb

    Download Submit

  • /data/user/0/com.popevacedosukepu.boyeyu/app_annual/alyqcc.json
    Filesize

    1.5MB

    MD5

    7e74547378d97764fcb2b5d2c4db53dd

    SHA1

    eb3958c5f7253db76b8fc727e28da4a4ccff1a86

    SHA256

    2ac5f86400a1c61f0da8a11b97e3bc3663e918354b15a3fe242d2e4931c501b3

    SHA512

    e6f17125a38aa1873d7caf6afa35e96e25b358d3eea7ce65fb3edc33eba0561feb9a520dbc1619001509c6244700ab1901e3113ccc33412ca77481c40933b65a

    Download Submit