Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    01/03/2025, 22:02

General

  • Target

    808b2efcfc28db5b072445482c8123231fd00258d5b3761a6536a3347df2f008.apk

  • Size

    2.9MB

  • MD5

    6acb44a2a17eb24da5f51b9bf7dfbfe2

  • SHA1

    86c6c15e204f7bcc8f18d6e672dbdfe3226030e2

  • SHA256

    808b2efcfc28db5b072445482c8123231fd00258d5b3761a6536a3347df2f008

  • SHA512

    599f3c2fc349d5f04a088f4e3bf1e0628a6ba1ed04e7e1c9d18c85da9e6bc929263cfd83780d89a85cafca37489864a6107ea5c904aca048c99b22ba85712670

  • SSDEEP

    49152:7DHvVps5b5ByeH97lLqHe+7sdT0+XFrkzGqZ9/j7L7EhYVAqaf8OpY7lPAxhK8xE:7DPVSmoVdPFrkzzZ98LfDEAhgJMvyB4e

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac family
  • Ermac2 payload 1 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

  • Hook family
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.tencent.mm
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:5159

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    702KB

    MD5

    9b27046e8007dded0e9963257fd1c044

    SHA1

    b65bb1f70731e5a20435269d99906ef0653e5bf0

    SHA256

    1430fae1e99473a5c9d8d047777741e370c7cb94f14db778e889b357d869d7e4

    SHA512

    2289b005955b987be1ec0890bd68625ae3b1c7ad5c853013b93ba396b5f9dd28d0a51c595d0b96b1d8918f11598c229a6a3c1e92a1fb6ce70297f23392fc793b

  • /data/data/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    702KB

    MD5

    b4ed5beb81681a541c94df8be1a50b13

    SHA1

    ced1fa6359857864ff2af7e54c6f47e8b2013ef9

    SHA256

    9f1c37243f247c0e555422da0754c5d90b51249656dba266d9741541bc3c6726

    SHA512

    9a4c6b62a015fedbe9c168f4ba3544fb3f440f2bb2574fdb0f5658e5b422689837d8eb18ee47b31994808e90d7f8e0cb23a49aa31878d75f973191203bf63bf8

  • /data/data/com.tencent.mm/app_DynamicOptDex/oat/miQpStX.json.cur.prof

    Filesize

    3KB

    MD5

    5dd130616132dbb03974082782f715b8

    SHA1

    606e4a2738555ca49fa498d9fa27ffe97ff39a7b

    SHA256

    2cbc88f1dd653b93038abc4768c2f11b4ecda3e0d09c5a9dd5be54709b7da468

    SHA512

    050261ca530451635ddf15cf0b25c3383c4808344ce84aefb0644a2af802c297bc4485aedd7b33e51808cf8242f8aad1c298870814263c3c150a1e7a797fae99

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    faa72b578c2aed181084fc491fb7eea0

    SHA1

    8da34f34538bd5478874132ddc9ef0989e1c67d7

    SHA256

    10c45a06afdb78bb5a0ff75a3d43b52318843c76f465e3191eb14273c6dbd40e

    SHA512

    ad6c6ad47b45c3a6a40b4fd128c1bfe5ddc93f8bcbe2592af2d656b6f5aaa9341fe9ef82178c686394afd2b63919895d220d667815cddedfab779b97f1d2dd37

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    4487775fbbad97b055e358df121f6db0

    SHA1

    00906e6c716e5683cd6a8370a38692e94b08b66b

    SHA256

    418d119e5879f4633a465bef3ff7d0a1672c5eb367530d744574f225d5273c58

    SHA512

    21d1621f516ebb49d2ec70d9200dfc21f0eb2f781371495335c6aabc03be8a95db6c54ee94dfaafdf3bd767980cc73c3ddad4a29e4b94bca66d5e364d927b458

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    480e1f9c8b573555d2e65bf994595390

    SHA1

    56f83db638612806f6df181746771445e61a795f

    SHA256

    3b1eb2786a8db50a1e8df5b6dc4ea2464c5fb98e6b4d2e91ea2508ca6fe28200

    SHA512

    74649eb368de7448a020958e7ac736e540b379816d9df1b8b9272f081ba24baa6c76ae8644b3bbf1ac880868c02caabb96f412d8b78a4c152552f9587803dcdf

  • /data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

    Filesize

    173KB

    MD5

    6c6e919a121aa2b94b43051f063d90b7

    SHA1

    0e0490a5f27b96fa3a724bae7740928adaf1c688

    SHA256

    335ed8965762318ec8c3975a1b232ffee9f0c60c102d6680a3ac229671e71eb6

    SHA512

    c8141955e319d5df3173b843cc5f728125ca03e3c87958ec0d57a5dd26336cf1dfac5c0ece1e302bea29b10daf3ece668a2788ff6cdf1d63b0652f2148352305

  • /data/user/0/com.tencent.mm/app_DynamicOptDex/miQpStX.json

    Filesize

    1.5MB

    MD5

    998753d51562c21f97f24a706e88fb05

    SHA1

    ac7536f8d79055812ff1bb1eb9c7d9859fb552b5

    SHA256

    f74f6f912ea01034f43112487a31bd8e3f3df7ccffa8804c6e6ec9e1995678cf

    SHA512

    b021c1cb0426d24b54b80fe1bc8c056cfac077f616e04e8b5554e34ee31433dc40fb638ca226f00f8e6f2f6350fec643dd7972bacb509f55132aa1f82eff2c1e