Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
03/02/2025, 22:03
General
-
Target
fa3f0a156c2c0156b0da707fe4153bfb6dda78e5c2a481e83fdf520608b4c209.apk
-
Size
2.9MB
-
MD5
d8f6d05e76dccf32aab72fa25a32f86a
-
SHA1
5775ac48ace88ccfae42ace5092e4571dae99cb3
-
SHA256
fa3f0a156c2c0156b0da707fe4153bfb6dda78e5c2a481e83fdf520608b4c209
-
SHA512
442a93002c86f1a5ab2d824a6200f1330fab4e9d96914d3fcd038ce21bed93705b0b807ba9540c44cc9546231a1a4413e0df97de9d92f40504c3b3a47e4f63ef
-
SSDEEP
49152:fDBD6UPbUvRsetJRb/1B9WGqHv+LsdT0+XRjMNyPUnZq694FbhYVAqaf8OpY7NLi:fD8UDUvCsJRrD9WHdPRjDcc6941LfDki
Malware Config
Extracted
ermac
Extracted
hook
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD5e0a7b9663d764c3b2de2d96082c55d36
SHA1d5c8504acca92a1c988440aceffeb967e831aca3
SHA25643478eacb0e94f1e20700883237d95d573e64c75a9af7dd28b010e0682590b58
SHA51228d9a48392e9de1dbb55d537e25dbf04810f9de87ba532299e9843e078133d86ee81f40e2d03a8cf91480b37c541442afa04863ae7261e8656089670ea3776b9
-
Filesize
702KB
MD53fffaaabc4dadb19df49cdba1eb34086
SHA1d1e7374eb9f26eba8a5e2ba57ca98144e1932674
SHA256cb7dea2461ddfc5a435c1a8faa4a592aca0c40270ff0eeedf5d956945214de89
SHA5120514674c5aa1d2be95b86f8ecd1f81c20323916a92097b6118baf39432032c182149879e8484d231effab639df3692c4482472efad465b8952b25aa1933173c6
-
Filesize
3KB
MD59805218d1dbfb065d4a8419dd9a10491
SHA1f1290cedd8152feee00d8e607db2b32bb7ad7535
SHA256f3447f1f4975f52d4182d71a9abaecf9a03b704aa02aeb767918e5236d8b0c36
SHA512cd1a5751399a6a0ffabec6ccec4f495986add39d9f19c467d0734ab1c525784e664bb9c88cc2bc6e46de25449bda9331e6e4ff7613b350e63d74a3bd2261cab9
-
Filesize
3KB
MD5f6775b8346b9053d7b6c8fb375961213
SHA191012a1d70c416234101e2e5ff34520202ad4360
SHA25663c2a5e426d0e688f4a2b35efe37611e577ad0dcdc1b3b98e16b2b2e01c81630
SHA5126c0290d998bdc658eb093264670fdb65e0751706078112b96e561f0fa6e9571fc7926c0e573c170eb28f6489bf9505c11a362512d89a365cf7a2fa2c6c6683dc
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD55b9a167245d8489e828b8b0aaf90a407
SHA164dfba0ec8e2541eb316d04cfde77983737cfff4
SHA25610136591ca3f2ab1afaf970b5ea216bc1440859bcba7abd0155b47b7efd10190
SHA51241fe42c7ff50347ae8bf920d657aa25225b029fa2edd471d468c44e57ed9dec1a4412192f947d5bc5e10912eace697d3cd541b0b543a55d0f08f19860b64c1e5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54f5ab3b3120df260e9cecdffae54c443
SHA1d0871952183fca0cd2df0c6d0a19d09a288b5fb2
SHA256aaf58fdc8da8a4611007508ce7fd3bcadd43599b325eae99cad9d0221b3ccf16
SHA512b86fc0b795e5667efc9210b0c6d6ebd2bb06df20c57c4e31bfb254d7937cc40bb60977ddd3688f4a9b3609724b76076b2004f8bec40edb492fa173ede097002c
-
Filesize
108KB
MD5e1801a933883c3372b1710c61638de42
SHA12d1e66bf2416cc60a4f6d1aa85f8182b954cfa39
SHA2569684a63cf04dedb0ce32327354b622acc397edc337464bae94fbc729e6917d60
SHA512aee544e66dc3681ef85d23b359b653feaec338f19188f3ac63a75c5914d888189f33381aa9df90fb15b443d2d38e82c1767e92804dceb72d6ef2ae449fa49995
-
Filesize
173KB
MD538a175443ebbe44474d6952158652dba
SHA15bb4990df20aaafffbe9d2c28a0edaf4c4e4229f
SHA2561eaa7b8d829c7e3feabb206be9eedbe998ea301d3163dae405b8b62ce58ea53b
SHA512454460628d2a122ad42429f7c169f693c9fde6b9144f2164d4835b8d8c3cbcb49af1d6f25a8f0311c36676e3ead688c3779d186301594f69ce599c21b1718c68
-
Filesize
1.5MB
MD5ca6e266ed3c7cb632ef078128d83954c
SHA1d09d3e65191f2f6bc996099489393ef70770b057
SHA256c4ee0f1429ba75054d31dbeb857dab88609a56fdef2adee489016de400937c3a
SHA512a4d24bc74fac1f152ff200227a2302a0c8a7c09ac2b4e4f6746c1533fc1f6aa80b2096acdd7fdadd814c385257031c0d074481dded4a4834e2befc7ff02e3476