Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
153s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system -
submitted
28/02/2025, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
-
Size
3.7MB
-
MD5
6470a944afaac6ceb464d6a8305142cf
-
SHA1
79ca5a6226329bb1a3d990936670bb7bd2b3bb82
-
SHA256
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978
-
SHA512
f10441007eb4161750e056d62105f6991a410a3324a11df4178346a651f11d9410b5e9fdf08f0ea1ea877cf9f6011b4e737563359d92d579d04ce2ed158afa21
-
SSDEEP
98304:IeZ8KggD4xc7kby2K7SxpPZJ3f/5FpknIxFXj7wCn:qgDH7k2pkPfFDn
Malware Config
Extracted
ermac
http://xzophgf.pro
http://vbqmzif.live
http://tvubbrtsj.pro
http://cvbasdewtyu.live
Extracted
hook
http://xzophgf.pro
http://vbqmzif.live
http://tvubbrtsj.pro
http://cvbasdewtyu.live
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral2/memory/5154-0.dex family_ermac2 -
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.birixipawipejogo.saha/app_deer/GgrRP.json 5154 com.birixipawipejogo.saha -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.birixipawipejogo.saha Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.birixipawipejogo.saha Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.birixipawipejogo.saha -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.birixipawipejogo.saha -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.birixipawipejogo.saha -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.birixipawipejogo.saha -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.birixipawipejogo.saha -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.birixipawipejogo.saha -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.birixipawipejogo.saha -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.birixipawipejogo.saha -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.birixipawipejogo.saha -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.birixipawipejogo.saha -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.birixipawipejogo.saha -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.birixipawipejogo.saha
Processes
-
com.birixipawipejogo.saha1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5154
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691KB
MD5fbb52658a9741d4a540cb659cd1a68bb
SHA1805c3ed78867b89b828ccf93d2b77d2ee0a405f3
SHA2563d83c7db8399c80936634bfc6ee3cb32911a33d894ac3aaef372cf8e5f3ae17a
SHA5123f85286fa6b579be06cdced244f8e95f48582516faddffa236e339dd1f7657e11dfb58c58291d9831aa2623efdece3dcc46aca153b4e57a16a133999f28da427
-
Filesize
691KB
MD592087b393980072736731cb3b63444e9
SHA1a8b3ecf1a6837dc3c5256de6c58c8ce0e17f0a74
SHA25664efd537150f72dc67f26d6b74bd1b8f32bab097d9d3315e26f975711c7d84d5
SHA51215bce7410bf4221a701608c092864d1a0b049afdf3345e84931d52bb3b99320e8e0138f77e8e1da900b79146d43b2e5cfef8914a2f5dc7fa52f8bc101cda6ad7
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5f743660beaa73865e84a0d32ee0f24be
SHA15a02469fc6dd9cd79fd58ffff682bb3d6db4362c
SHA256f1a2f45d2e40f13014a0859a95250234772291622405408385958442cbc9bf2f
SHA512f38b589cc1da7d3533de69007f61847b9c1f47707cd69943f9f063e8310ace4e815b599d892d5da4023e8b5ac1997a364c57c3d7905f13d0a86f2acc60ee2105
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b77a09078bb7118d6d936f66d5941223
SHA1cc550fe6466aaf6cd5a8c018b4ffcc4020b54a28
SHA2568616158daf8474d7497f5f659eff7102bf9dfc3808fb6988654144be716b84d7
SHA512e3818efbc7b3f3cdcb27344b050de5250a5ed312053b9de5344dd8162fcf62c51200c9eed1e69141149ae229a3adef58880c9d9f56e681ca9dfa77af069d0d61
-
Filesize
108KB
MD5466f8d9cf16db7c825b85c000c0fe0f4
SHA1ec44b0a58b4c4506ffa67483b04ba79b119de04f
SHA256a82701b6e396f0e589bded04ceeaceeb4925b547499f75fbfc028ed409b16dc8
SHA5129329e19cda42f0e05f5170ba18af2a5f772838c8f5180a5b3fa4d0165a68e08276ea88427eb3993100560a32f9fc3b275aa57268957aa46dae60d7d07cedb2ad
-
Filesize
173KB
MD57ecdb368c5ce20465e0dcce1ee8ca3be
SHA133f729bd7936bb38301b4cf656635f750aaf34ab
SHA256e2735f3cebb1858ccbdb07ffa25603d81f24aceb0feac10477516953c24a5077
SHA5121ae5b5bcb19e69377d48f23d04198cfb8dde68a9d677758abb54029554e34b100f9f3a941fc4f02c5c54c6ca9d608229500662ad5fe1527eeb9ea8fa7a376561
-
Filesize
1.5MB
MD540a06eba1bdf356d9df1593b3a4def32
SHA1ed0920508acc5ccb0690dcf5b7e8df5e2b84bad4
SHA2561feb5c0a5a8e13795ffaab110bf19524663b4eac43f7bd40a3a3769455e65cef
SHA512e995367ac79b2738897f4d196a5865f6a5d3d76d8f15ea2c6db9e809a5593286c4faa951f25479ea24c0502a383a9aeb98af1548fd6027f4fcfefb2285182b37