Analysis
-
max time kernel
148s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
28/02/2025, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978.apk
-
Size
3.7MB
-
MD5
6470a944afaac6ceb464d6a8305142cf
-
SHA1
79ca5a6226329bb1a3d990936670bb7bd2b3bb82
-
SHA256
9841decf8e0c882dec874d6bf7915a8b14a0b1abcf0684df192718f464e4f978
-
SHA512
f10441007eb4161750e056d62105f6991a410a3324a11df4178346a651f11d9410b5e9fdf08f0ea1ea877cf9f6011b4e737563359d92d579d04ce2ed158afa21
-
SSDEEP
98304:IeZ8KggD4xc7kby2K7SxpPZJ3f/5FpknIxFXj7wCn:qgDH7k2pkPfFDn
Malware Config
Extracted
ermac
http://xzophgf.pro
http://vbqmzif.live
http://tvubbrtsj.pro
http://cvbasdewtyu.live
Extracted
hook
http://xzophgf.pro
http://vbqmzif.live
http://tvubbrtsj.pro
http://cvbasdewtyu.live
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral3/memory/4770-0.dex family_ermac2 -
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.birixipawipejogo.saha/app_deer/GgrRP.json 4770 com.birixipawipejogo.saha -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.birixipawipejogo.saha Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.birixipawipejogo.saha Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.birixipawipejogo.saha -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.birixipawipejogo.saha -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.birixipawipejogo.saha -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.birixipawipejogo.saha -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.birixipawipejogo.saha -
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.birixipawipejogo.saha -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.birixipawipejogo.saha -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.birixipawipejogo.saha -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.birixipawipejogo.saha -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.birixipawipejogo.saha -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.birixipawipejogo.saha -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.birixipawipejogo.saha
Processes
-
com.birixipawipejogo.saha1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4770
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691KB
MD5fbb52658a9741d4a540cb659cd1a68bb
SHA1805c3ed78867b89b828ccf93d2b77d2ee0a405f3
SHA2563d83c7db8399c80936634bfc6ee3cb32911a33d894ac3aaef372cf8e5f3ae17a
SHA5123f85286fa6b579be06cdced244f8e95f48582516faddffa236e339dd1f7657e11dfb58c58291d9831aa2623efdece3dcc46aca153b4e57a16a133999f28da427
-
Filesize
691KB
MD592087b393980072736731cb3b63444e9
SHA1a8b3ecf1a6837dc3c5256de6c58c8ce0e17f0a74
SHA25664efd537150f72dc67f26d6b74bd1b8f32bab097d9d3315e26f975711c7d84d5
SHA51215bce7410bf4221a701608c092864d1a0b049afdf3345e84931d52bb3b99320e8e0138f77e8e1da900b79146d43b2e5cfef8914a2f5dc7fa52f8bc101cda6ad7
-
Filesize
1.5MB
MD540a06eba1bdf356d9df1593b3a4def32
SHA1ed0920508acc5ccb0690dcf5b7e8df5e2b84bad4
SHA2561feb5c0a5a8e13795ffaab110bf19524663b4eac43f7bd40a3a3769455e65cef
SHA512e995367ac79b2738897f4d196a5865f6a5d3d76d8f15ea2c6db9e809a5593286c4faa951f25479ea24c0502a383a9aeb98af1548fd6027f4fcfefb2285182b37
-
Filesize
3KB
MD5239082001cee6e6aaea8a893098ae35a
SHA15cf1716eeb4fb4ca449e6c0bb46e21871e3085c5
SHA256a3322d8b4623ce971b1a725ebf81f5a4e070d19a58d14cdcc249bb475aeadc73
SHA51278ddf7602698054ae6cae96addd1f699ff8c4134f69034fc97f4eb2d9738072a1b4b66f7d6a2ea99ae8b200fff40537f4e7e57965a8564f7872d6dde6db62acb
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5c192312b2f5edf8130b1a04f3fe1344e
SHA15ab4a0882b186e5160bdf53427a19bd0e709f059
SHA256e613d0ffd493220056eecac49a8ccad8c95b1b0f79e20c38b4f8bfe5ec2d841b
SHA51293e32a5e4378a6c40ad4c728f389ecc85232cdda8b274bbf5aa61af056912db23a74cbd90346301f090b1c338cdf487bad440c42fa161ffd30daf231ae4fec5e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b7e4e3ca6b6ec59a969bb67ac803dbb2
SHA1c6dc30c96b53bee5d865d3c79b4179a25a0de3b7
SHA256481196a4d52f9ad2c9436f0b4b489a37bc91e1b92450fbf13e492ddea1a0d96e
SHA5125a2d53c525c9b5a102b6c9c6d99151fff6150115c56ea7c9ac700904083afc0bd22dfe6e285d84ce900e27f9a685f622bed768e0c3051fa969c542c85a30e6b6
-
Filesize
108KB
MD5986788affe94e45628404c5d96b9d9cd
SHA19c442bad1048b023d74e975ea3fee428a5867c6b
SHA2560e7a768d00c38b316e2919617fc4b58b25c1eb8f071e387fd404785536cb37d1
SHA51268ea02193575446a7a5a14709f9394f9f99e8e1f209847605241e3a51af7a8dc77573e0df5b7a2156464f9ef2420e7a57ef20b0ae786e86ebbd2ebc4a12d7aba
-
Filesize
173KB
MD54176c9917179c006a5f3f6976be7f64f
SHA118152be8176b37b55b0c0f670e8a4a1a69cd5d20
SHA256f52c8fcf3f522b40ead8eb08b061ae12cff9c0e800bc9415328da6e0f7b13a66
SHA512a449777063236f99655020e1925ae4a9095edfc3ce8365dc3a80eb3e65c8ce84840e4973889c08ea5c7fdc91e3cb4dd0cf1de4d9ac860636af343e2e3e4ffb15