Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    01/03/2025, 22:02

General

  • Target

    808b2efcfc28db5b072445482c8123231fd00258d5b3761a6536a3347df2f008.apk

  • Size

    2.9MB

  • MD5

    6acb44a2a17eb24da5f51b9bf7dfbfe2

  • SHA1

    86c6c15e204f7bcc8f18d6e672dbdfe3226030e2

  • SHA256

    808b2efcfc28db5b072445482c8123231fd00258d5b3761a6536a3347df2f008

  • SHA512

    599f3c2fc349d5f04a088f4e3bf1e0628a6ba1ed04e7e1c9d18c85da9e6bc929263cfd83780d89a85cafca37489864a6107ea5c904aca048c99b22ba85712670

  • SSDEEP

    49152:7DHvVps5b5ByeH97lLqHe+7sdT0+XFrkzGqZ9/j7L7EhYVAqaf8OpY7lPAxhK8xE:7DPVSmoVdPFrkzzZ98LfDEAhgJMvyB4e

Malware Config

Extracted

Family

ermac

C2

http://82.146.54.42

AES_key

Extracted

Family

hook

C2

http://82.146.54.42

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac family
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4342
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/miQpStX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/miQpStX.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4368

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    702KB

    MD5

    9b27046e8007dded0e9963257fd1c044

    SHA1

    b65bb1f70731e5a20435269d99906ef0653e5bf0

    SHA256

    1430fae1e99473a5c9d8d047777741e370c7cb94f14db778e889b357d869d7e4

    SHA512

    2289b005955b987be1ec0890bd68625ae3b1c7ad5c853013b93ba396b5f9dd28d0a51c595d0b96b1d8918f11598c229a6a3c1e92a1fb6ce70297f23392fc793b

  • /data/data/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    702KB

    MD5

    b4ed5beb81681a541c94df8be1a50b13

    SHA1

    ced1fa6359857864ff2af7e54c6f47e8b2013ef9

    SHA256

    9f1c37243f247c0e555422da0754c5d90b51249656dba266d9741541bc3c6726

    SHA512

    9a4c6b62a015fedbe9c168f4ba3544fb3f440f2bb2574fdb0f5658e5b422689837d8eb18ee47b31994808e90d7f8e0cb23a49aa31878d75f973191203bf63bf8

  • /data/data/com.tencent.mm/app_DynamicOptDex/oat/miQpStX.json.cur.prof

    Filesize

    3KB

    MD5

    a9e2a961c9d367cf66e3a22bcbb1d732

    SHA1

    d253c9a59e8b7812be9d7d7fd5dce536c9d7a886

    SHA256

    47cccb6f43553f934375b6e1dc1e517d2664ee6f84d2bceae397bd5116862b6a

    SHA512

    007cc819c74fcb4eb91d5c4a5be1f67d2fcfe3154beafd767bad0d8f3951b8b88ff0bfdecdee97e4f35d0f830d48146be5e57ae6d6cf9d1a590d6935cde0f0ef

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    a7279383dd6c1b4a16306c35e49fc123

    SHA1

    57a5011f8f856a1ea0c117861a2e0e7cc968832f

    SHA256

    223e2cf39acc4e8fac12228d1d17c664e126c52fdff301f33a7eaec4af8619ec

    SHA512

    9d3a9786545b3c9ecf6edf12ed7fab7c09d0dafc69543ef364d0219d735cdd70aec0beeb16aaf65d24591e082ba7e70c97fd7729c8d2bbee284eff79a5a11a85

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    42637a1e94685cd8e60781e0ae066878

    SHA1

    3210660579ca3202454d5f6167a77ca64ebfc441

    SHA256

    d1c91e5778a401e7b817ff36e1e20a6c37cb823101b0ad26dab6b481b2dd47a4

    SHA512

    06279127a967adbd7e87dd748039250f6feed200386e5c8f94506cb4ad659c8b671b9b5f332ebcd0cd78937f2c8a4f5e5756c1ccaac53faab34d2a7db281e0e9

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    6c6682c8f9f6564c09cb889adc11346b

    SHA1

    85d5ff737f98d85bf659945438878e9a7296544c

    SHA256

    de5f91aef1e1c30b16d9743b496476f06a54b4a1b00c2a13b8bf85adc1ab46bb

    SHA512

    433dbacf49fce3ddd31b3e1b33b71e609a4e0d3a94aa383b054b3b702a21f45cee9afc5950de22cbd61eb5203f5d4d0fe7f8423324262957b617177a191cdcc8

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    cc6f30d0f673e8016fdc23ea39446649

    SHA1

    35f22f540872cb609d4a27b5d072f171321954fa

    SHA256

    acb92e3409198e1083a1432883087706e53d7d36969eecfffed1da31b6a7c591

    SHA512

    aed11defc4e95703fe61d91c8b50c931597d05252a431a519e458cbdd29a8c88d00fd959e471a94dec6e25c1284282e0778550096b5dcfe6606d51e96168f2b4

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    1.5MB

    MD5

    d51df16801c110364830c2f1d1c7a350

    SHA1

    58f08cd53516d1c2f62be5f11919bf647b665195

    SHA256

    ca1c2bc1c203b8a1a06fc4af5a0c4e6cf3cd607bfac0b4b79f17792f01dcb821

    SHA512

    a6c00cbf538adaa95ca506eb9f7fcb027f573f2b98b1856d3bff7d566a3b94ae6a216dbe912a111a2217ffcc8e9d76300c3df8e05fd182d24675b69ed84eb929

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    1.5MB

    MD5

    998753d51562c21f97f24a706e88fb05

    SHA1

    ac7536f8d79055812ff1bb1eb9c7d9859fb552b5

    SHA256

    f74f6f912ea01034f43112487a31bd8e3f3df7ccffa8804c6e6ec9e1995678cf

    SHA512

    b021c1cb0426d24b54b80fe1bc8c056cfac077f616e04e8b5554e34ee31433dc40fb638ca226f00f8e6f2f6350fec643dd7972bacb509f55132aa1f82eff2c1e