Analysis
-
max time kernel
47s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
01/03/2025, 22:02
General
-
Target
808b2efcfc28db5b072445482c8123231fd00258d5b3761a6536a3347df2f008.apk
-
Size
2.9MB
-
MD5
6acb44a2a17eb24da5f51b9bf7dfbfe2
-
SHA1
86c6c15e204f7bcc8f18d6e672dbdfe3226030e2
-
SHA256
808b2efcfc28db5b072445482c8123231fd00258d5b3761a6536a3347df2f008
-
SHA512
599f3c2fc349d5f04a088f4e3bf1e0628a6ba1ed04e7e1c9d18c85da9e6bc929263cfd83780d89a85cafca37489864a6107ea5c904aca048c99b22ba85712670
-
SSDEEP
49152:7DHvVps5b5ByeH97lLqHe+7sdT0+XFrkzGqZ9/j7L7EhYVAqaf8OpY7lPAxhK8xE:7DPVSmoVdPFrkzzZ98LfDEAhgJMvyB4e
Malware Config
Extracted
ermac
http://82.146.54.42
Extracted
hook
http://82.146.54.42
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 2 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/miQpStX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/miQpStX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD59b27046e8007dded0e9963257fd1c044
SHA1b65bb1f70731e5a20435269d99906ef0653e5bf0
SHA2561430fae1e99473a5c9d8d047777741e370c7cb94f14db778e889b357d869d7e4
SHA5122289b005955b987be1ec0890bd68625ae3b1c7ad5c853013b93ba396b5f9dd28d0a51c595d0b96b1d8918f11598c229a6a3c1e92a1fb6ce70297f23392fc793b
-
Filesize
702KB
MD5b4ed5beb81681a541c94df8be1a50b13
SHA1ced1fa6359857864ff2af7e54c6f47e8b2013ef9
SHA2569f1c37243f247c0e555422da0754c5d90b51249656dba266d9741541bc3c6726
SHA5129a4c6b62a015fedbe9c168f4ba3544fb3f440f2bb2574fdb0f5658e5b422689837d8eb18ee47b31994808e90d7f8e0cb23a49aa31878d75f973191203bf63bf8
-
Filesize
3KB
MD5a9e2a961c9d367cf66e3a22bcbb1d732
SHA1d253c9a59e8b7812be9d7d7fd5dce536c9d7a886
SHA25647cccb6f43553f934375b6e1dc1e517d2664ee6f84d2bceae397bd5116862b6a
SHA512007cc819c74fcb4eb91d5c4a5be1f67d2fcfe3154beafd767bad0d8f3951b8b88ff0bfdecdee97e4f35d0f830d48146be5e57ae6d6cf9d1a590d6935cde0f0ef
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5a7279383dd6c1b4a16306c35e49fc123
SHA157a5011f8f856a1ea0c117861a2e0e7cc968832f
SHA256223e2cf39acc4e8fac12228d1d17c664e126c52fdff301f33a7eaec4af8619ec
SHA5129d3a9786545b3c9ecf6edf12ed7fab7c09d0dafc69543ef364d0219d735cdd70aec0beeb16aaf65d24591e082ba7e70c97fd7729c8d2bbee284eff79a5a11a85
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD542637a1e94685cd8e60781e0ae066878
SHA13210660579ca3202454d5f6167a77ca64ebfc441
SHA256d1c91e5778a401e7b817ff36e1e20a6c37cb823101b0ad26dab6b481b2dd47a4
SHA51206279127a967adbd7e87dd748039250f6feed200386e5c8f94506cb4ad659c8b671b9b5f332ebcd0cd78937f2c8a4f5e5756c1ccaac53faab34d2a7db281e0e9
-
Filesize
173KB
MD56c6682c8f9f6564c09cb889adc11346b
SHA185d5ff737f98d85bf659945438878e9a7296544c
SHA256de5f91aef1e1c30b16d9743b496476f06a54b4a1b00c2a13b8bf85adc1ab46bb
SHA512433dbacf49fce3ddd31b3e1b33b71e609a4e0d3a94aa383b054b3b702a21f45cee9afc5950de22cbd61eb5203f5d4d0fe7f8423324262957b617177a191cdcc8
-
Filesize
16KB
MD5cc6f30d0f673e8016fdc23ea39446649
SHA135f22f540872cb609d4a27b5d072f171321954fa
SHA256acb92e3409198e1083a1432883087706e53d7d36969eecfffed1da31b6a7c591
SHA512aed11defc4e95703fe61d91c8b50c931597d05252a431a519e458cbdd29a8c88d00fd959e471a94dec6e25c1284282e0778550096b5dcfe6606d51e96168f2b4
-
Filesize
1.5MB
MD5d51df16801c110364830c2f1d1c7a350
SHA158f08cd53516d1c2f62be5f11919bf647b665195
SHA256ca1c2bc1c203b8a1a06fc4af5a0c4e6cf3cd607bfac0b4b79f17792f01dcb821
SHA512a6c00cbf538adaa95ca506eb9f7fcb027f573f2b98b1856d3bff7d566a3b94ae6a216dbe912a111a2217ffcc8e9d76300c3df8e05fd182d24675b69ed84eb929
-
Filesize
1.5MB
MD5998753d51562c21f97f24a706e88fb05
SHA1ac7536f8d79055812ff1bb1eb9c7d9859fb552b5
SHA256f74f6f912ea01034f43112487a31bd8e3f3df7ccffa8804c6e6ec9e1995678cf
SHA512b021c1cb0426d24b54b80fe1bc8c056cfac077f616e04e8b5554e34ee31433dc40fb638ca226f00f8e6f2f6350fec643dd7972bacb509f55132aa1f82eff2c1e