ermac | 23ee97cd77193c1ca4e9b0999f9e7b476846b38923fcc63a5253a257820b7f82

Analysis

max time kernel
42s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
03/03/2025, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23ee97cd77193c1ca4e9b0999f9e7b476846b38923fcc63a5253a257820b7f82.apk
Size

3.0MB
MD5

a34cc1710ee255271c72ff016564019c
SHA1

718008e05bcb501c139b012c4942d15d6ff42f94
SHA256

23ee97cd77193c1ca4e9b0999f9e7b476846b38923fcc63a5253a257820b7f82
SHA512

e1d6c477e0da6a29173089a9587d8a6f6ea5effa4a832c9b962d0bd7e3ae522a68e4621e4f3ba31e5ed28a00f3f90a5ccd5d242f8a1289f5866dfd1b85b3faa9
SSDEEP

49152:eShYvJewvte4/6gveqHn+GsdT0+Xw0WYc7kdUVorlhYVAqaf8OpY7tsh/LK8Fg/r:eSEeQvvwdPw0KW4klLfDzhxgnFGyB4C9

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

ermac

http://91.107.127.201

AES_key

Extracted

Family

hook

http://91.107.127.201

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4361-0.dex	family_ermac2
behavioral1/memory/4336-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4336	com.tencent.mm

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.mm/app_DynamicOptDex/tXZBNM.json	4361	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/tXZBNM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/tXZBNM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.mm/app_DynamicOptDex/tXZBNM.json	4336	com.tencent.mm

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tencent.mm

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.mm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tencent.mm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tencent.mm

com.tencent.mm
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4336
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/tXZBNM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/tXZBNM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4361

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/app_DynamicOptDex/tXZBNM.json

Filesize
702KB

MD5
bc336f2de0e3c5423324b960742dfd2d

SHA1
57a7bdaee344d37195ab1accf2fbafee7079b2e2

SHA256
9a8fce51f69e8517708a5c4b975048ef040151764bb552972710133b313bc9d6

SHA512
34cd1ecb5a73525aa5d9abd600439ea6e55d9d9f3c6cf86dc06aed0b9af07320dbaab27cfb6bd04766f1d27c4d35bf90241b36f84dd61ce5a0bc53ee12bc8e25

Download Submit
/data/data/com.tencent.mm/app_DynamicOptDex/tXZBNM.json

Filesize
702KB

MD5
9b58616f460c2962b6af510eca88c0d5

SHA1
943b7d5400f7ef597845cfc04306d612c869474a

SHA256
e67fcf0f3d1fac9e7493ead579324541b293dc0fcefb2c6a1ea00d0b4e5cdca3

SHA512
0d17bcce69c36705697de27ad37b1367b98855eb95ae463a2608e2dfb46163230d39f1d4eb0f3407e03d2c1cd2947ca12a5406f82d7fd4d848b29a856ea8303d

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
3a192349551046a96f27d6bdc5b9f468

SHA1
b8c6139a0fbe40cf2807e746f5c46206110bfe7c

SHA256
ff28cece069d164227b17d68ae65a9f167fdd1474ba71598dfc90ecc6b37c699

SHA512
5d7353c807722e6b429d0590111ca3a1ef7f4a574dabffa3ab5d99f1d22df2b36874f6e87b1b09250df894eb5b9bd1d65554e280a5e58cf6d3fb36c262a2ca1f

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
56ab4ab78f7bed9f0823df31e73d6bdd

SHA1
e843d592e0873482e15f085f6b6939899df7149f

SHA256
461a94ba18c41e9ed4c6d59b059b6a515277e773118fbe02cb45f9b060fff0bc

SHA512
6878692a121b1fb70b77d5204da2dd498bcf172138814acc07a4ed8f91cba442a83e3fa8dd59820b0f9b9c0f26a14e0c36651aae6d1ef3d4410a4eb82693243c

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
eaa8523639234992baedf4d57c40ed2a

SHA1
bf118f393921c0b2583ff126cd50d66461889a45

SHA256
384924380cab5d5a1eb4e79c780c9f54ee753a6f07332047d6c278745f0a2b92

SHA512
8e10bc3ec8c2ff72f681777b933ee1e0f55ec0c5ca67d3091a4bce873d2ed95e5881b26dc97b89bcc0bded662a853da7eaaa6c56ab1f057d0eb3d3fa238e529c

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f5cc9f97cf35f4a918b578a076b0a307

SHA1
88f546ad75278d5a35f30eb110b7cbb28dd09631

SHA256
2a01043902b117efcbfa862fd5c3fda181e776645fb747d39aee92ffbdd05f2b

SHA512
46a8d5600a1f62d6001d265afdff3f5928f44eaae5291e0811fc50dfc45ec827b81e90cf365d8b312444ac23f7693ffb434b4ecbb59058ca6e50708f2dc52849

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/tXZBNM.json

Filesize
1.5MB

MD5
b2ec7bd35a3192d6f6d31c40553cfaaa

SHA1
41a179e828a900d3934525ffa6e31887b4ae138b

SHA256
b9b4437984074db389e44371a9d994b931e0b48b81675be7626861b03a31d9ab

SHA512
6622514102a16f5de44b043b4dacc9adffbe3d67abee6d7268cc9c1efc689288a05f5a3a147e9f11370056db00fe2119d14319d478a6b80f35fa84c53e167663

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/tXZBNM.json

Filesize
1.5MB

MD5
89e0d7ab978e192a89d66d518e3ddbfd

SHA1
2c908a8b8f56479fdb3e5b1ab0a0e8fef5673e70

SHA256
955de22dedd8eef99abf727b30cfa42836e4a9eb2d427ee5977c10e6d62d4005

SHA512
be014d2788512c6747595dd0f912043e1197543e75bd622ca47a5b080783a7e59ac5341c68a87af8a92487d789ae40ce4aebf747ae4e12e5f1e2575cc4570dd1

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads