Analysis
-
max time kernel
146s -
max time network
157s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
01/03/2025, 22:06
General
-
Target
020a1731f996a6440e29344be68c25cc2238cc6fefbf1c63c1084d6300bb73d0.apk
-
Size
3.0MB
-
MD5
a806c91bc15c6fa250f71b8b45528e1d
-
SHA1
f9e590ef456303f3ed9aafc3966a20e83a919384
-
SHA256
020a1731f996a6440e29344be68c25cc2238cc6fefbf1c63c1084d6300bb73d0
-
SHA512
a2065f004e619319a8d180eace8bd5efb4fc75e40f3c2863d2b57bdcfb44c1431611b5a9f98e7c2749590bb58c96420c04594247284fbdf29f6d27f816ac448a
-
SSDEEP
49152:XHkuzDKGRYY5pqHp+gsdT0+XC7mCjS0XJQ6TGz+bhYVAqaf8OpY7x+3bPK8lg/PY:XHkHYXdPCFXJFaCbLfDx3ZgH/YyB4CV0
Malware Config
Extracted
ermac
http://176.123.168.62
Extracted
hook
http://176.123.168.62
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701KB
MD5dd507df4888dbaad6c64d5b77b0beb7f
SHA1dda6f5c082058beb9a60c70858af009a0f71a2d2
SHA25660cd9fb5dfe86c5328e82d32a4a826a2c00400735ed9adeb15a34c1ace1e5f63
SHA512d49c12ac5b789dbc684ea18c3afb73d9f583631c73f3497232cccf53040f04396b1ab33941901bce4d0eebefdb42fb750da5a7a7640d32c05a38ac039621d1d7
-
Filesize
701KB
MD5badc9eb139d9474cded9a53bbb8cac9d
SHA15a25dcc8b957c77f65932de8f0cfd056b6d1cff0
SHA2561723cfc3c10e81e8d9d67a2eae25705c5896afdf3fb0b47210fc094030c6ab97
SHA5125c26e3564822654e6623a788b3680f141b4334268836251de284503ebbf50eef4ab54d2fde0e44b72f6e9776c91350d143f62fab9c7eb79b78cbf12be60f7c62
-
Filesize
3KB
MD59e3d7da0039a10286188a49f1fb654bc
SHA1e33901a387d6d3bd11936e953c4b133646989d50
SHA25620a178545b8ede79a91045d93329cafc01e3ddedf92b69cab13b5c973d5e5f44
SHA51200b09a610e34ece5e096db6703419790458e4b95e0379674fa7698b275ca1e1cd9d0e3aaf2b859d2c8e30b727386448eb3144ce1d9b2190f587c361abbdad881
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5e9ec39978863f3983e7e91bff4581568
SHA13ec53d2d7765065bc922c3db77c1260e061e2b54
SHA25617f0809e428a3c7c68e908d75209fa23071247ece33d7d3582b347942a709237
SHA51255400e69c4b7938a953a566fd642d13a3cd7c490eef64b7bcaa1f23e9fbab470dcffa0f4540c3fd27df7c57ddcfd3b33a8c8b7704105e90a9bbdd5e07ee6fc41
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5c63e9b7f24391b99dca87b847ee19ae3
SHA18486d10d3a3264e7cfc6979e794646b30ae35067
SHA256f4d48347dea849328a26ec4bca8bdbe6303c70e73e7b76ad6d33aad2af79a5ea
SHA51217f75199ecdf8747ca4b916f91ebdaaf19c4be4fa5b7679a0b8d89ab9cc47a9b00026bc881225a5b2f91b1fcd19134c433a8171888b25be26c94da238a02a3c8
-
Filesize
108KB
MD5b649874bb4bfeed14790f0a30a12950d
SHA12644b940392d35935cb97f752efc038ab4d59317
SHA256b6867fef41777fd5a7c0ec1292de3dfc8efb49aefb136778d094f919f97f41bb
SHA512645383bd82c70e1e7dbb233120c6ab28ace33dad4ccd90cf9ee3ceef7a757ebec70aafa0485fc2fd46037be71b0d81a10ef2b3ffe470a1fe91eaf5211b8bc5a0
-
Filesize
173KB
MD5ff897a2720e6da0ca1835052b58f2851
SHA11e692aa611e526ad780798399c26b8d5ac3fddff
SHA25642ce3ac7554cab35a049d6e707596c4099df268579ecd2cd9cfa6da299c7679a
SHA512c5720fbc87966313ab983806ebac6b16829b758173fe9e7fe1f859ffe24c50fa5f2afba87b3a2ab03237aae607c371de88898bb4243d34564a147f9fc94891ee
-
Filesize
1.5MB
MD57f60b07ed6592877ff7d6a081eebe253
SHA12005ba9cbb222e2d5fef82f91223d32c5bb1a71e
SHA256841459c86ceed636626616bc027ead9721cdb9c015492802a925a2b0edf0a7c1
SHA512d180fb35c7550d0952f9c6952093024b016d1dce47dc814414181f5f36ae020f7456fafbd46d101934bd2392e57e102435c6a3ad02ca5c29f301580a05712e4a