Analysis
-
max time kernel
148s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
06/03/2025, 22:08
General
-
Target
782628fb2d316667fe65903efe6d4e9afdc7dbcafa0d5bf33203e0f6fcc40642.apk
-
Size
4.5MB
-
MD5
d879ff85d5ce1b13f7deb565afb88588
-
SHA1
6567693fd429aacaf2323f8a5862ca9ee7455312
-
SHA256
782628fb2d316667fe65903efe6d4e9afdc7dbcafa0d5bf33203e0f6fcc40642
-
SHA512
cce8ba50eb388330b34455ec1840c38d8fee998c869d8a99aab438780d22c110fb88d36a4a5d1fc74882b890e26533ee5e0e3ed4bd1b990ea37a62686661f962
-
SSDEEP
98304:TSueyeMMn6GSdWJtU5HV7LrJ/OvwWKtD6LNaBJvPbMNixCivmjFOOWrb:e7pMMnx0WJtYdXcTKR2WlQjo
Malware Config
Extracted
ermac
http://185.172.128.82
Extracted
hook
http://185.172.128.82
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD572e72c2d87176edf48bc9598799c5ed9
SHA1b8b2498f2c825fdaa7215b981704bb7c721c7552
SHA256de7c43300d9de54e74e81ef40863201bc3456d5c6c4e8fc17297018a40fdba08
SHA512df0f9f80ab902308272945cda1a75e42c88efdf4dca65b9f0565a8ea2dfd8de40b27498290495cf2ade0d32873d796e443f8ae5a63471b6b5622bbc1a3b3450a
-
Filesize
2.6MB
MD517ea3c2a99554884d3fa8dfe31bc058a
SHA17cda060e58c485600fe9157e93b7bdc8548af9d2
SHA256474a5d1f6d4a6298f834194596948edcbd3cc41392da5d4dd52d2c74439e19ce
SHA51279e57f7b85892f46e0e3e7cc14de395b75a60fd4b4a85084d9e89ca6e41ada0de2613f9423fa4ead758f20c74b97ffb4053503a750d7c708e93f94d29bc79e8a
-
Filesize
6.8MB
MD5464955a9c23aaf3a8ede10d14b927b21
SHA11d4d422bc2dc9c4e958fda976c9c05a70897887a
SHA2565d5c9fd5578a9f1fd4e653bd6f88c024ebe238025316a48488f7c559f46fb0a2
SHA51247d3e65b344fe63ce633944cfcc23af61275976f396a0f5bb733a64fdac3327c650e191ef20425c19fcb97a21e2c00ad0b0dbbba8f3546503d767866b65f9b63
-
Filesize
5KB
MD5b2bb066ebb3ee8bf68f6b0c9b70c806d
SHA13cb14819d240b93287a928664e1cbd0da90c1072
SHA2569926d68e832dacd196cea827d3acc40665612032d70987420a164f9ab8442c39
SHA512503b150abf61c7175a0f92afcc1fa2d0c15733d75be0eea2a6d137793b352285f1b8c512358f4e3ef011aba827cf0d153457b41e410b3e08486eef6731949096
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5ec1b9394f8a63afc57f484228eec08f9
SHA1bac840dfc7c682f3161ca39de3cfd6b4ba65409e
SHA25698b8579e442239695bed3f8cfb2e913236406fdae7dc01d743c0047ee9604ceb
SHA51296dca57747c2011616f48ee66e0621d1c786bfb53ab480c779792833a275fa64eba23f896eedf5e7a74bf1cdadf6b8ae68e2d11ce06236df60b30774c7d4a0fe
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5b92a96d7c281f8c4a2711a84d54b78d7
SHA104b543cb2fe12fc8289df34223262fa694e7d488
SHA256f8be089e4379f23376446887ba1076d6222f36419a0cf2c8e018e91313086cde
SHA51200223cd0a9d626836b4cef706fccebdb8677b9fcc566a53fa11dc3807ced1159de89d88ba2fbedd229f742daa15ffe0bcf55664d609f96d1e3bc94e02ec2b9a7
-
Filesize
108KB
MD5f41157103fbda7703e7d9f3494e42568
SHA1f6e3a182c8693b6b99b828c12f43750a71d9bfa1
SHA256a7b9a31ada27a7731b24c0f98127b001db29109d00e843b47cc7471908d2ffc3
SHA51275c429b0ecc0c19ebd655710511c13e26741bec6c7ae319c6edf24eda4c748ef3c870d10cdae4583e484643ca26a6830b536453b28de44e65c24c6e49a0bd929
-
Filesize
173KB
MD560eb842d010611ee5913c385e71d2dce
SHA1f4400c0763d70fc36fc65d88d84a1515b3608df6
SHA256c5ac898573e320a64a3486bb5b42439466119b2e28e126d65d83cd8263fd95f2
SHA5123e86f3529e170f2a5dda22ae22a7b9cfeedc8a3906b16154b1e5099b737d673c1f4b264f394675663988bec464e019fba83dec7a8da2864d87f8043251a76f26