Analysis
-
max time kernel
149s -
max time network
155s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19/03/2025, 22:12
General
-
Target
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk
-
Size
3.0MB
-
MD5
57ce9375e1571b1ec1d8cb36ffad5b75
-
SHA1
128c17fc8f6dce59502bfb330524900a73a01e79
-
SHA256
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66
-
SHA512
fa12f970c1a9edcb167a0c9a1b2f1fa2712010fb76325a82c6cfe1d5772a7c6fa80ad5dd20e62f94a96b2bd9fb4bebfdbec2c38a6d8cc786ec21ff5211fa62ef
-
SSDEEP
49152:QxXoHQDz3hwIc30hG+PbLqHq+isdT0+XkYSlNyR/Ia/8GBhYVAqaf8OpY7lAtHbZ:QxY8Jc3I1bQdPkYNP8GBLfDntZgf5Syc
Malware Config
Extracted
ermac
http://80.87.197.162
Extracted
hook
http://80.87.197.162
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
703KB
MD57036e1ebc564380e72414a4ae742d14d
SHA11d80809e4be3279fd77fccd1edd86051ff1934ae
SHA25699b48ae8cb05ff46f23cd94d3196e042b37f4949af438eafdebc3aa71459a85f
SHA512ef793ef449fb8cc773a83efa67d6396d88f7f73b68d7a3c32578f6040e91417b56c26f0ccc3c712b4af4f41fa955b6518463a5e86027192e5ae1db67e8d985dd
-
Filesize
703KB
MD5ed494f937b47e81787bcaf9f782cd8d9
SHA1080db0c22e4505cac4fac99d68ebd3d5276d43a3
SHA25686c34d8dd3a96745efc8129df4615c7c8b6f4e82cb11d13615e77ddfe92d143e
SHA5122a783a3c4fb4cb0051010c3d1eda1461d2be38c871b0ec6b0112548f6f7790908244d3a20b2946afc1a6734af8a564ece7d57f6f4edcd1a1a81ad46ea5dff188
-
Filesize
3KB
MD512ffacee5b1830e6785bf88ddf14aae0
SHA1d1882349fbab8180aa7c16285e98eb56c03405ac
SHA256f67381b67de9cb39790c703e225f0061cc5a15aa2241707fd290a966d2850bf1
SHA5127983674150fd9adae290f04901fe273cde1ce761e3af1c6bed26f3d160815fd0348c701d63d31f111e35349c5510339065c5a92df05fa1a8ac4e1b84452eb917
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5db342e9250c0bac18bd37e4e44b34e13
SHA1a7a5104f6915e083161e6fce193ff428741c4c94
SHA2569ddf48bf8c050893d1a1bd7633b6d51f58fde23aaa4fc831b3b01f0736c62f73
SHA5121076c21e1ddfe5aee8723d58fbbe39ad4e01638cbf99061e9206543230aa5cb38aaee90cf557c06d26455dcf5a2cddbd0610a76364b69342c618fd826709be1e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD59831acad91c3c9afd8d857c2c94e24a5
SHA1bdad94adb231f01727c8f87a4fa70a5df04bb637
SHA256a7140d0d85f540943c9cbbe3be35c9644335f007b93463125a0ef2b0b5e0902c
SHA512ca3e5d0fc5b9d86c02ffa2708205b0155d9df901e447e249c0b92366e794b2fbe9e0bed354c507e7d746428f62ffdba83ce032df11cbf2fd8ab70117664dd12c
-
Filesize
108KB
MD5ce38cfc5eb4c2c0b8da73592df064972
SHA13e62521e07cec73b2b77d759d32fe2aca3024cdb
SHA25669c0770e4910cdc11bee60086cfe1bb32bd2eaf44b614dde95659c06c7db5836
SHA5124b36994295f9bb956ad716b364162ca18a8b6538e13a188a1955a4d85e4ef41f79d70c30e56a01cc7d8ce43860990047907f0698ce6804421b37dc6d0608d639
-
Filesize
173KB
MD57b0224b5cca1fa83be3f7430dc3f2581
SHA1243b6fda64d47283b8f83e2dc8bebcd49c5a1cb6
SHA256e611095412c244968197d52da7154e225c512268d7755bc2a67d12da20748185
SHA512e1fd7c0051c8c3d47e0cb0b6597f0603065c8baa839a18fae8db162b206d0cb99c7f84a4ccceb9e9ff53fb7a7c3488342e448e24a05968762fae70b6800a7bd2
-
Filesize
1.5MB
MD58abe1776ebc0143c41a8a6d094595815
SHA11365273a8f69eaa5d3d2af99783b94c8fa2a2622
SHA256475d7bf5bc9c08e50677bd53df71fd79d50561bc48a7d5446ca61174fed101ad
SHA512741528a836f230418ffb4c36df9a3a9b142b0ad1689f0acc3821d3f34b4a4264ba50bb5b73706f13595622d538d259124bec1d7ff5c62ef601a91a5f11702fb7