Analysis
-
max time kernel
148s -
max time network
149s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
06/03/2025, 22:08
General
-
Target
782628fb2d316667fe65903efe6d4e9afdc7dbcafa0d5bf33203e0f6fcc40642.apk
-
Size
4.5MB
-
MD5
d879ff85d5ce1b13f7deb565afb88588
-
SHA1
6567693fd429aacaf2323f8a5862ca9ee7455312
-
SHA256
782628fb2d316667fe65903efe6d4e9afdc7dbcafa0d5bf33203e0f6fcc40642
-
SHA512
cce8ba50eb388330b34455ec1840c38d8fee998c869d8a99aab438780d22c110fb88d36a4a5d1fc74882b890e26533ee5e0e3ed4bd1b990ea37a62686661f962
-
SSDEEP
98304:TSueyeMMn6GSdWJtU5HV7LrJ/OvwWKtD6LNaBJvPbMNixCivmjFOOWrb:e7pMMnx0WJtYdXcTKR2WlQjo
Malware Config
Extracted
ermac
http://185.172.128.82
Extracted
hook
http://185.172.128.82
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD572e72c2d87176edf48bc9598799c5ed9
SHA1b8b2498f2c825fdaa7215b981704bb7c721c7552
SHA256de7c43300d9de54e74e81ef40863201bc3456d5c6c4e8fc17297018a40fdba08
SHA512df0f9f80ab902308272945cda1a75e42c88efdf4dca65b9f0565a8ea2dfd8de40b27498290495cf2ade0d32873d796e443f8ae5a63471b6b5622bbc1a3b3450a
-
Filesize
2.6MB
MD517ea3c2a99554884d3fa8dfe31bc058a
SHA17cda060e58c485600fe9157e93b7bdc8548af9d2
SHA256474a5d1f6d4a6298f834194596948edcbd3cc41392da5d4dd52d2c74439e19ce
SHA51279e57f7b85892f46e0e3e7cc14de395b75a60fd4b4a85084d9e89ca6e41ada0de2613f9423fa4ead758f20c74b97ffb4053503a750d7c708e93f94d29bc79e8a
-
Filesize
5KB
MD5188a4172df89ee23234d344f02700a81
SHA1cbaa4f686e5fdf475b1417b53be584d897cbe4e4
SHA2566c5bb5a3cf50ab3cd7ea2e37ae2ad4033f6d556ac284ef5211bc28bf69d17446
SHA512a46ea05d37e787c55ded07abbf403953ee87d2250e53b7e19545c6842a1d0321eacd30e298a288f8d2d8ad825189b80408af6747e71d4c33df78a08ac32b7798
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5cbb58de496d1753ff0c33b1da76f7a3d
SHA1f0187459f4a52ec038768ead7bd708b08a97c554
SHA256b194ae64ffc6e1339f5c9605424ecc6680208a114400c16522649a09375efee4
SHA5129994e32522419beebff7550df29746367de89a6119d70cb235a35dacd37e57536bd97d5d0ff00e20f4eaf5bee8b0208b6181fd7828e2652280362751fa86edc6
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5eb43a0f526be271efc0d6d6efc98dc12
SHA1f0c710f82dab619e13f2b21300445b95b9902543
SHA25683209c2770b54d7b8fc4fe21fcfe48dd791c9790b58b7aadfb1e313bd85e1ae4
SHA512e5b921383c1c1ce409da2a91fe268188ccdc971181a211cd2a7941b3c3fe4f458c8a4abedb76e8952e5ef66906b76d65098270be90df4d71fe6e8779c47bfded
-
Filesize
108KB
MD57f5459a5a541f57d909bddc09a868eca
SHA1d31c10974f495da1c38e62096c02093f438d216a
SHA256e27b46f4fab33ce3f11c005809b882bbdcc7167581cb152bffc1d1e9aa861d8d
SHA51235358a679edb5c60bf313df55279db074dba473c9636f8a54e48a47f2296e8d17ea5e303048d93dc0ed2769eb869f4576993abd3c1703a7091b6e4f1deb1bccf
-
Filesize
173KB
MD56d95b2f64c6e79392f6ada9d35788e67
SHA140f6096c9f95d8c1b7f2b22dcfe397312c55abc7
SHA256d9f751f9809c3a89ab4fb3a1fc845c966429a59edfc60a9ad2a8ac0fc4add8da
SHA512a807e6a435baa53444b755b1b1d4dba179456c50b5b8e91493055656502137bc39c435a57357803191bab691a98985983c5aa7b4f92025580e077581b66bcb01
-
Filesize
6.8MB
MD5464955a9c23aaf3a8ede10d14b927b21
SHA11d4d422bc2dc9c4e958fda976c9c05a70897887a
SHA2565d5c9fd5578a9f1fd4e653bd6f88c024ebe238025316a48488f7c559f46fb0a2
SHA51247d3e65b344fe63ce633944cfcc23af61275976f396a0f5bb733a64fdac3327c650e191ef20425c19fcb97a21e2c00ad0b0dbbba8f3546503d767866b65f9b63