Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
05/03/2025, 22:05
General
-
Target
7d31e6e4ebe8a39fe457e40286db9158e93d981da07aee2deca041309e6f43c5.apk
-
Size
2.9MB
-
MD5
9361ef2e226d4f9fbd9fdb93f0a8c4cf
-
SHA1
40482f000e317a84d4468fc348a8cd7424997acc
-
SHA256
7d31e6e4ebe8a39fe457e40286db9158e93d981da07aee2deca041309e6f43c5
-
SHA512
016ddfe60ba0296c35a37ffa8c0f3d66fb970042b3701068004c52d7bbe221c3446afe1ca380b3a2c2c316a5e716f7f4281f6c42fb006fd8aaf16d917ad9977f
-
SSDEEP
49152:Dm9/oDLptsvFf3nw/YSI2nWyjavqHC+6sdT0+XsAz70RGr6x+v3YIji7ywhYVAqX:Dmpstuf3nw/22+UdPsAi3IjYywLfDrhC
Malware Config
Extracted
ermac
http://91.107.127.201
Extracted
hook
http://91.107.127.201
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
702KB
MD5ed9c7aa4973092f7a19c112fbee1d0b1
SHA1763adf2e5310239e21c532e44abe3e90c7cae95b
SHA2565ae89702641a1fd25e4a9b5964fa10fe5582053c3e283d804283ecdfb242336a
SHA5123b94988d6ea2a2e105cd8cd267cdde6a48dc711948a41fdda8fa21ef9d62a5596dc8bfe5e47c5dc6d030d37d533de333adb9f809c7591917071e7117ff4766d3
-
Filesize
702KB
MD55c7070e86c9405def6ff8b458f0c7c71
SHA12d232932bdee30a7df9d837eeb62fcf27ef0be21
SHA256bba492c5bb82c610aa9a620e5dc7db51960e95eac6ddcd3c8e6240f8e4427aba
SHA5124e27678c2e552657e85b851903d3ec42a47465864bd3a83d733b4bdfbcc7cee96afa01f472d8714691dfff8feb877ad9adba0ad35c5df2857f906d1574ab8c4c
-
Filesize
3KB
MD527c07ce0adf054a02477191e1bb8d8c6
SHA14b97ec840ab1887e65ba39a42d70e0f207a1148c
SHA256bc1d254423c99c59cd3572360d8b57645db8965c9ad115443ef0df18d6b248d2
SHA5124284f63d7a8295bbae0a12300e843d074b55e02056f74b7079cf2df4d44a754dbe961715f5f2996a947269a8baa3c450696e705073c4f68d130d8a62e3b53ac2
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5260e4e36a3ad5728a9dea01d9a42a214
SHA172e220e3b297c3eb80dd9b721a750b5a70508ff2
SHA256ab7f00594c557f8f52b27f4b3bd2969012e3d23f68023f5da37bb6081cef1031
SHA5125efb1750376422fd2f9554de47aa61528b302b2a25b9379ffd07232a872f571b555d842313745df985c30b6a0e00b0e7a542c086cbe992cc0f1c969c859eb73c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD511c37126982a2457a5548a8593829689
SHA184429792733de0a241c2a444fd8d2e5402f0873e
SHA256ebeeba1c91b614bfd7527b603df594484f3aa3dd3d2b9d5fa4925a762096da27
SHA5125323577a5fbda5fa47a827912f40a6d9ad0f600343b5c2483c3254b2040c4e9870fc738e2e06c2db98c1cf4ad39bd0895b22415c8391578b3af3ec6879784a04
-
Filesize
108KB
MD55972d06dc3c9053fd4f7081461a70b62
SHA13a76f8a17d7c6045a14499232129e399892391dd
SHA256127bfaa979f5db54272da343e533f0c5e23166cf8592ba40706ba73e32d8b9df
SHA512c4341f2fd94bbdb47d443a1c0a0a4b2cddb90801eb02aa3d5d26b87ea62fe3e3cc667c5158c3ebd0aca902d656bfc0eb263ecdb586e2a8b862160aa27f8654a7
-
Filesize
173KB
MD54c1fa6e81553f9364be95ec90fd2042a
SHA1e6dd88bea528a9441ff6148444f4ca53d8b75c8c
SHA2567efb1c037b704827f9efcd0d51483c61d1336211a6b608db9f756f76c2315fe0
SHA51283fb784c5b832f8619aae97bbc09a76f35b4fd59fcc0652b9d9b3ca5e5a000888d91df57ab2d3ceb4b9b824244d148976dcf475bb247a1135f42895ad6aefc11
-
Filesize
1.5MB
MD589e0d7ab978e192a89d66d518e3ddbfd
SHA12c908a8b8f56479fdb3e5b1ab0a0e8fef5673e70
SHA256955de22dedd8eef99abf727b30cfa42836e4a9eb2d427ee5977c10e6d62d4005
SHA512be014d2788512c6747595dd0f912043e1197543e75bd622ca47a5b080783a7e59ac5341c68a87af8a92487d789ae40ce4aebf747ae4e12e5f1e2575cc4570dd1