Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
06/03/2025, 22:08
General
-
Target
782628fb2d316667fe65903efe6d4e9afdc7dbcafa0d5bf33203e0f6fcc40642.apk
-
Size
4.5MB
-
MD5
d879ff85d5ce1b13f7deb565afb88588
-
SHA1
6567693fd429aacaf2323f8a5862ca9ee7455312
-
SHA256
782628fb2d316667fe65903efe6d4e9afdc7dbcafa0d5bf33203e0f6fcc40642
-
SHA512
cce8ba50eb388330b34455ec1840c38d8fee998c869d8a99aab438780d22c110fb88d36a4a5d1fc74882b890e26533ee5e0e3ed4bd1b990ea37a62686661f962
-
SSDEEP
98304:TSueyeMMn6GSdWJtU5HV7LrJ/OvwWKtD6LNaBJvPbMNixCivmjFOOWrb:e7pMMnx0WJtYdXcTKR2WlQjo
Malware Config
Extracted
ermac
http://185.172.128.82
Extracted
hook
http://185.172.128.82
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 2 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/Cb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/Cb.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD572e72c2d87176edf48bc9598799c5ed9
SHA1b8b2498f2c825fdaa7215b981704bb7c721c7552
SHA256de7c43300d9de54e74e81ef40863201bc3456d5c6c4e8fc17297018a40fdba08
SHA512df0f9f80ab902308272945cda1a75e42c88efdf4dca65b9f0565a8ea2dfd8de40b27498290495cf2ade0d32873d796e443f8ae5a63471b6b5622bbc1a3b3450a
-
Filesize
2.6MB
MD517ea3c2a99554884d3fa8dfe31bc058a
SHA17cda060e58c485600fe9157e93b7bdc8548af9d2
SHA256474a5d1f6d4a6298f834194596948edcbd3cc41392da5d4dd52d2c74439e19ce
SHA51279e57f7b85892f46e0e3e7cc14de395b75a60fd4b4a85084d9e89ca6e41ada0de2613f9423fa4ead758f20c74b97ffb4053503a750d7c708e93f94d29bc79e8a
-
Filesize
5KB
MD58389dec6e45283b4954ef71753939b8d
SHA13e89f95400f20674feb63747db0425a1b419125c
SHA256f0861388fcc9bddc952d56d5e9c515eb6148cc143b995bcd42bf83863bf83ad2
SHA512b61d493d8e4cca8f99f211904b410acddb9b72a6f3e17e0becd4ba0d3d4855b01e8f94fcbc789aa3d4a704f450e5d7f76c0686350e1321c5808ce2e2c8a00412
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5d2af6ed1d0dbd000e4af5c0bb2b8a083
SHA103f174d9b49f1bc7e3d96d1bb268f55261ec8a54
SHA256dc545aa101308d1375a77fbc5d5aa80f25945357a57f06956418837e71daa90b
SHA5127e4c9ee7efddb03e578e252ee7507e903b897d1ac5865549a9affdd1ee5482be18a2ce7a5d462c191b67e5e4a6df52f7a2299b7505da0ab2c2a59137e31d54e3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD57056c8cf1b8bbffd56ea1de872683978
SHA1d50d77f9d0fb4cc793dfe5378eead78009d9b569
SHA256df85975b859a6f56e901f9865523eec50c62566cf1ac6e62fa631f1ed90ad7b5
SHA512a9e561df48a3d2a003edd33573fb473bb52da06072db74a18fd824424a80b885a3f0da24a4dc6e60ffbdfdbdc1f8a2a8ed00eb9bec74b9abf5b2fdb8edca1896
-
Filesize
173KB
MD5f411e73a5ba2966fbaf6836725a1c77b
SHA1943e51378ec0fd18195753bc26fa3071c840606e
SHA256e37ae0ddf1b128651511dbb0edd0ec1f7c6cbec1bb45efddfad0850ffbdc853e
SHA512efe586a3f2bcde3aba30c548fc5c6cca6b73cadcf21c3dff00ee9a58682fc95554d5afdca96467881793289d92fbd04e9d6753a0f25b1863a3eadf94507ad9a7
-
Filesize
16KB
MD53acd5d8ce1ceeaeb8747a4d9bfff4019
SHA12648da74a479eed1e09036bc826735b14c0614ab
SHA2569e823c004b6be563d96ab4f90921f27925fbebcca619cb7746d700ab0e1012ee
SHA5120622c127c80ee03fc2e05e2692b5d963d0a1b9520a102afdc204ecda9b133e6494630703ffa0fac29377515632e5f00b24b9fd0c51da6f29bfbb8b7933f12e9c
-
Filesize
6.8MB
MD5006804533fc1d8a8cd508fe315682cb1
SHA1f0cbdff2721c82177fa1323d17479215eedb291d
SHA2560402b3845188b99d80c896c82071f70259995668951f2f01673fa95b8c4b3cc7
SHA512f5cf05ff54f72184e14f97430e9a560616b1dcb2e0aa8c269500138c5b5d214f5c4cc536602a9860aefe081bb2d478b15ea6a444446e60b4093e560d8699aaa7
-
Filesize
6.8MB
MD5464955a9c23aaf3a8ede10d14b927b21
SHA11d4d422bc2dc9c4e958fda976c9c05a70897887a
SHA2565d5c9fd5578a9f1fd4e653bd6f88c024ebe238025316a48488f7c559f46fb0a2
SHA51247d3e65b344fe63ce633944cfcc23af61275976f396a0f5bb733a64fdac3327c650e191ef20425c19fcb97a21e2c00ad0b0dbbba8f3546503d767866b65f9b63