Analysis
-
max time kernel
60s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
03-02-2025 22:03
General
-
Target
fa3f0a156c2c0156b0da707fe4153bfb6dda78e5c2a481e83fdf520608b4c209.apk
-
Size
2.9MB
-
MD5
d8f6d05e76dccf32aab72fa25a32f86a
-
SHA1
5775ac48ace88ccfae42ace5092e4571dae99cb3
-
SHA256
fa3f0a156c2c0156b0da707fe4153bfb6dda78e5c2a481e83fdf520608b4c209
-
SHA512
442a93002c86f1a5ab2d824a6200f1330fab4e9d96914d3fcd038ce21bed93705b0b807ba9540c44cc9546231a1a4413e0df97de9d92f40504c3b3a47e4f63ef
-
SSDEEP
49152:fDBD6UPbUvRsetJRb/1B9WGqHv+LsdT0+XRjMNyPUnZq694FbhYVAqaf8OpY7NLi:fD8UDUvCsJRrD9WHdPRjDcc6941LfDki
Malware Config
Extracted
ermac
Extracted
hook
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 2 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/khJhUZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/khJhUZ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD5e0a7b9663d764c3b2de2d96082c55d36
SHA1d5c8504acca92a1c988440aceffeb967e831aca3
SHA25643478eacb0e94f1e20700883237d95d573e64c75a9af7dd28b010e0682590b58
SHA51228d9a48392e9de1dbb55d537e25dbf04810f9de87ba532299e9843e078133d86ee81f40e2d03a8cf91480b37c541442afa04863ae7261e8656089670ea3776b9
-
Filesize
702KB
MD53fffaaabc4dadb19df49cdba1eb34086
SHA1d1e7374eb9f26eba8a5e2ba57ca98144e1932674
SHA256cb7dea2461ddfc5a435c1a8faa4a592aca0c40270ff0eeedf5d956945214de89
SHA5120514674c5aa1d2be95b86f8ecd1f81c20323916a92097b6118baf39432032c182149879e8484d231effab639df3692c4482472efad465b8952b25aa1933173c6
-
Filesize
3KB
MD55984532fab592002fff7952b944fe84e
SHA19cb22cdae60239bbc25889bd6690b263b26e0510
SHA256bcae19896eb421f479e30127e5664a7f4a64b608df913fc0225fa240a8189e49
SHA51282421a33d647015d50dc9ff4b8a998a4e0c405eab325251fda39004c695c0c40ea5160e212ab22012ca392efe47b8f819cec734766d7ab813343af1223f5868d
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5245fc44b5a6b15049cbf99b226e99be9
SHA1a3d443690042aef15e1b51034256a58790df4b84
SHA2569f4c240f1f3e8d996f95b88568329e60e2ddcf8ad774f285d711d47fb0695ee0
SHA5126753774b0f61bd11e0b28fd84e9c601a2b97f1549c2c1ba91948e24cf3810fb4486fb865623fb324deaa83da29b5e9a7b983b74b669c034222dd931872f792ec
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD54103bbe28dccdc7c78de8728c1e3c70f
SHA139a69e416c6625e1d9231e1affca5e3ca67d9dda
SHA256fa0145b5e9430cf3838eddad695d88829a2bdbb24312ea201087668ad9c8698e
SHA512c93a7d17c550415012aa9e181458552f9018fdcc8ad3f838a2c0a8256d64637d6d1e244b7aa8399819dfb86b50db5f1de33bf5d983079189bed345041491be51
-
Filesize
173KB
MD58b3be17a29f9d5f732b5c0161feee2dd
SHA1a879ae54d2a1c69c153545e3874009ee81bb01a5
SHA256deff7d091cec584c6ab1db443d0d4cc4066f8799375897f4b82beee86a27d5dc
SHA5120cb20f44db23116ab1db65bc3071810097aefae73ee9b38ca05e7b36613c1ee159b9419e42fb68ddcd0efcf25dcfd0aad05facc81415fd684fe6b341e1e275d9
-
Filesize
16KB
MD58874402d6438e9662cb089e4266007a7
SHA145fa74c7a66db26a52df3e16217b1e25afff1768
SHA2565be7cece9809a0b236cb2617f72b03d5eb7aab2d774d96550e3894ee20dfa0d1
SHA51295172f7a76974730031bb0593706d7ab30bfc0f88a4af344283eabea2390dd942e563a12b1fc3ef603050c2c8b3d0273f95cacd098a7b4d761c169e532020676
-
Filesize
1.5MB
MD548d527427142ae3e07f93b0bc5e3d62e
SHA1fcf28c47890fb829ed428a2d0374c47577b29d3a
SHA2568ab4e7d10830e876d041b5a0907ad65d0ecf1ccc008930e79ba2e3b188919599
SHA512b48666519be2ff81f87547df96613a9389f91affe58c3e85f3e9bd69e4e1e138d3ace493b36f2a1ef35f2f135a54d5ab1b08df3b6abf06db19789e34333e7a3c
-
Filesize
1.5MB
MD5ca6e266ed3c7cb632ef078128d83954c
SHA1d09d3e65191f2f6bc996099489393ef70770b057
SHA256c4ee0f1429ba75054d31dbeb857dab88609a56fdef2adee489016de400937c3a
SHA512a4d24bc74fac1f152ff200227a2302a0c8a7c09ac2b4e4f6746c1533fc1f6aa80b2096acdd7fdadd814c385257031c0d074481dded4a4834e2befc7ff02e3476