ermac | 8dfaaecbc8ed410c8d39999b750d12fa55ff6bfbbbbef5564688da14412c4b18

Analysis

max time kernel
49s
max time network
145s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
01/03/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dfaaecbc8ed410c8d39999b750d12fa55ff6bfbbbbef5564688da14412c4b18.apk
Size

3.0MB
MD5

f01c35786e239aec5acc0e4b1fdea4e0
SHA1

d9cb0d450658a3e8e6a53f511067b6ed3d6cdc83
SHA256

8dfaaecbc8ed410c8d39999b750d12fa55ff6bfbbbbef5564688da14412c4b18
SHA512

0780f5f69dcf9b7c0bd55baea0ae1e74e3a96acbf5604a192ca5859dc07ac89401ebc31a8f7b9731451093a5cc36bc9f6d9c0f30ac4dd1363de33ed9df1b67e1
SSDEEP

49152:Qxf2jfcyUCOSEd6NcqHD+xsdT0+XbVOhYVAqaf8OpY7hh0bR/GAhN8MRIuEikGcP:QxujkdLSE8NTdPbVOLfDa0b5GAhJEjWw

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4398-0.dex	family_ermac2
behavioral1/memory/4373-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.tencent.mm

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.mm/app_DynamicOptDex/gQw.json	4398	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/gQw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/gQw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.mm/app_DynamicOptDex/gQw.json	4373	com.tencent.mm

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tencent.mm

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.mm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tencent.mm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tencent.mm

com.tencent.mm
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4373
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/gQw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/gQw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4398

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/app_DynamicOptDex/gQw.json

Filesize
703KB

MD5
e197d08d1cbc1361ca1c843ed7e923d6

SHA1
93b57e201f9ab3e923ce16f677ab374c70469449

SHA256
31fea604cfead93d5ee2bc6ef1392960d38a5ae07764a13401c1036f12e41ab9

SHA512
9bec1db413e164c94aea95704eb1b932f79edb877aeac82cf89a133d76a6ca6709c5e2f7823cc102768765f1265d0db16f3ac73c31ea5a7d44ec4334f56c5e5b

Download Submit
/data/data/com.tencent.mm/app_DynamicOptDex/gQw.json

Filesize
703KB

MD5
ae00ca236dac70399f71b6c3f01440ce

SHA1
0b6c338dfd9a471e9cc908f3daa2e392572974da

SHA256
a7998e0a77600b5aae8d7ee10322c1b8db4ebbe3a7a7a8d73e59af9439767bf1

SHA512
066c56ec9f77148ef59bc91645986619905f01c98d0990d9eed6f04b39d44429dd2ef9554d10dd57660009a4f7c5d0f96c1ec5b66972aaf742e13fdbf6a2164f

Download Submit
/data/data/com.tencent.mm/app_DynamicOptDex/oat/gQw.json.cur.prof

Filesize
4KB

MD5
b920664332709bb665c73266902f1d93

SHA1
c5a9c2466d6b3f398a81112e005740ef2462daf8

SHA256
46275aa43d912d3ead27c485cd08412df12d56b68ed7b98ea84a9196eb981ef9

SHA512
5f9826dbbd8ae7ca6ee6b2393a630087a7b7f41b0cb228be99da625189eb2357c289da2b8cb426281b977dcfdfc0987539034e4efa8806021482d613c2095aa8

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c5cdf239924b5b002cb81f5a75dae992

SHA1
848323862b5864e79eee808188aaaea3b9b6c68d

SHA256
cfe886198a57037c38aaee76a830bf85e0a38a59f6e415339b93524052e66c32

SHA512
8475ba0880828045325493fbdc83aaa2cf7238bab58d382a70964421fe1998e3380ae18df6224fc4c6647a48482810fdd02747e0d519d15e390fdfbd88f12506

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
9fa62e7d60e0ad74d5742fa67db845a9

SHA1
0a33ef751f5acbc41a4eed58aae95bb2e1861c2f

SHA256
192831a32ac789d505f6ae8b4d66ea2f28238bac6e247f2f88ca842a4bd11781

SHA512
3cf34982988e108f8913f3c478c84dd81f45596be83440c5a7cf5532a1d0418421bbace0ad81dc63dfbc6d9761812a4e541c4541ab33d4ca49fe5c498af93954

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d35c52ff4ba6fcac019c02f3da7fb6bf

SHA1
74bf9c7cc21d69b685a2119307d7c376f1d1e804

SHA256
7ee238bbb073d2bd2ab232a462c6d2c75a65433db8bd40cddfde14665e0a3bd2

SHA512
29cf4b7a036d4579c4dcd2fb2413fd0b23b14b47885bbc90e4575a7d86f50cbd08021437639b4b0807659463eb551ed13db714b9be5251d1c03bbe65ec722055

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ea9dc6061a4c4c3f86eb27d086ccfbd9

SHA1
1017b2acd64035005b1f8ceaf6d8fe5e446514c3

SHA256
adfc1c1aa57b6c120104f5302a37f63cae7f86b5b439de72bac9581de0c85d9a

SHA512
4cea120d3516bcef9f5208da42d62726b756b7a6f6c2e63fa9d5c5ae8eac82270b83efa42ae47c878958f7f31e927c55578408ecec1d60baa3f4a15540325226

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/gQw.json

Filesize
1.5MB

MD5
788da7e9d8cae011afce47fde394824a

SHA1
9593282c0761f43dfe107fff7079262b5f0bb816

SHA256
18fed1670b08954b0a14f9040cc4c6647e2250f35a8641f57f5d5ebc65cc449b

SHA512
0261973d48b0bf94e183f32a242e2c1789244e0630ffab53bb1ccfd3fe25e6d8270780e0ca04cca7e814f47ce5c12fba617d0067dffe367bfb93e930d2084329

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/gQw.json

Filesize
1.5MB

MD5
3e79e0d69fbc50ffafc8cd17ae5ebd82

SHA1
b6c9453499b56674b6b5bc81f3535f5800035ca4

SHA256
d00bf27b86ace39fbe639b3e024388897181c452341cac0f066b79be122c9cf4

SHA512
5c4acb3bcd4970674ed9cd7ec4f3f23acfb2b3777f49bd2421983976f3ab7015bc30bc57d29fb91c4e546b11fa9e9704b812bf86f910e58755000c5be841aa33

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads