Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
03/02/2025, 22:03
General
-
Target
fa3f0a156c2c0156b0da707fe4153bfb6dda78e5c2a481e83fdf520608b4c209.apk
-
Size
2.9MB
-
MD5
d8f6d05e76dccf32aab72fa25a32f86a
-
SHA1
5775ac48ace88ccfae42ace5092e4571dae99cb3
-
SHA256
fa3f0a156c2c0156b0da707fe4153bfb6dda78e5c2a481e83fdf520608b4c209
-
SHA512
442a93002c86f1a5ab2d824a6200f1330fab4e9d96914d3fcd038ce21bed93705b0b807ba9540c44cc9546231a1a4413e0df97de9d92f40504c3b3a47e4f63ef
-
SSDEEP
49152:fDBD6UPbUvRsetJRb/1B9WGqHv+LsdT0+XRjMNyPUnZq694FbhYVAqaf8OpY7NLi:fD8UDUvCsJRrD9WHdPRjDcc6941LfDki
Malware Config
Extracted
ermac
http://91.107.125.247
Extracted
hook
http://91.107.125.247
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD5e0a7b9663d764c3b2de2d96082c55d36
SHA1d5c8504acca92a1c988440aceffeb967e831aca3
SHA25643478eacb0e94f1e20700883237d95d573e64c75a9af7dd28b010e0682590b58
SHA51228d9a48392e9de1dbb55d537e25dbf04810f9de87ba532299e9843e078133d86ee81f40e2d03a8cf91480b37c541442afa04863ae7261e8656089670ea3776b9
-
Filesize
702KB
MD53fffaaabc4dadb19df49cdba1eb34086
SHA1d1e7374eb9f26eba8a5e2ba57ca98144e1932674
SHA256cb7dea2461ddfc5a435c1a8faa4a592aca0c40270ff0eeedf5d956945214de89
SHA5120514674c5aa1d2be95b86f8ecd1f81c20323916a92097b6118baf39432032c182149879e8484d231effab639df3692c4482472efad465b8952b25aa1933173c6
-
Filesize
1.5MB
MD5ca6e266ed3c7cb632ef078128d83954c
SHA1d09d3e65191f2f6bc996099489393ef70770b057
SHA256c4ee0f1429ba75054d31dbeb857dab88609a56fdef2adee489016de400937c3a
SHA512a4d24bc74fac1f152ff200227a2302a0c8a7c09ac2b4e4f6746c1533fc1f6aa80b2096acdd7fdadd814c385257031c0d074481dded4a4834e2befc7ff02e3476
-
Filesize
3KB
MD589429dcbd6e15b071d781ae99b0de62e
SHA1a31e2f8acbb8c8f31d44fa7d5224a2e2a5312eb5
SHA256b0a1da4ceb4f7c58fab8c15cb3fdba9fc16035f728f308ec6b301b01fc4b10c5
SHA512ffe87774fa257a23d30895a989c6ece8e52a3900550ba63150a4bbdaa69162164a05c5a97a8b4a970cca1ac97ede0d5a94728f4da3a2a11bbcea92c8d87dd9e6
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5e237433c5bc14027f5bdf890acfa04f5
SHA11a82cfcd597a9a342487fb3f8a5af6c0232f4f7f
SHA25651615963669ccead7f01e9b4cd00ed710c77a38f0206a5172217c8260566f792
SHA512a5838f33d46bc065d869a0e243001b76539c1ead309e3a3049c39fe5992067f529e5ff29560aee8935e7ce4a4acc6fcdea6a307960c94f70aca3de1f5fb703f5
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD56378f6ab7b0ab3ff06c5ffe451fd8ea5
SHA130f579ad5f5f6f46ead8b34a3e603d3ebef5998d
SHA2563f674ad09533e7d09db4a020cf8a23614e17e3c3ffed71a823a977a2cc6d6706
SHA5125b72a22cc9faa2e06163f39f679993d228811a3420c623df689d0bef0c05c25809e42daf9660ec3693ae2e19811eeab196d52f7c9656d034ff901be011a48ed1
-
Filesize
108KB
MD592934b736047f7365bf7d25c6775c0ce
SHA1242cee4c645024c3b75a49edacc9b2aeb27bbf9d
SHA25604afda5f9cfa7d08357b8e65f023cea5f686015a3a9908f2f81577da91b290ce
SHA5129ee6ccf26f257cdf38180b7fc3dea11884f420c483b1f46ef335b74256f7c05ba9f2993b0ec72f9c580104ca4493e70a26c9881cdbdcb5a4fff8ae7afadbf67d
-
Filesize
173KB
MD5ecd63c05634794dc97ace37f50a55986
SHA1c90ace3b9615047bece7581bf2a054cd8b220ccd
SHA256a6de7726d6c6180f23d9c3aede40b73c77eb4d01132ca5b1fa131b24ad7829a5
SHA512e7125d816b9bee1416014328fdb4db0f8aba0574e8d300fa9cb32c2f9891004479d08c3fb9847af36f0536d22654cacd0537991bad9018cf8fede7f4c0f6e7f4