Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
19/03/2025, 22:12
Static task
static1
Behavioral task
behavioral1
Sample
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66.apk
-
Size
3.0MB
-
MD5
57ce9375e1571b1ec1d8cb36ffad5b75
-
SHA1
128c17fc8f6dce59502bfb330524900a73a01e79
-
SHA256
4cffa1649f8fb89bab4738b5913605adc7b67b9a0bb32384901d335f94a97e66
-
SHA512
fa12f970c1a9edcb167a0c9a1b2f1fa2712010fb76325a82c6cfe1d5772a7c6fa80ad5dd20e62f94a96b2bd9fb4bebfdbec2c38a6d8cc786ec21ff5211fa62ef
-
SSDEEP
49152:QxXoHQDz3hwIc30hG+PbLqHq+isdT0+XkYSlNyR/Ia/8GBhYVAqaf8OpY7lAtHbZ:QxY8Jc3I1bQdPkYNP8GBLfDntZgf5Syc
Malware Config
Extracted
ermac
http://80.87.197.162
Extracted
hook
http://80.87.197.162
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral3/memory/4736-0.dex family_ermac2 -
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.tencent.mm/app_DynamicOptDex/GiGklII.json 4736 com.tencent.mm -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tencent.mm -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.tencent.mm -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.tencent.mm -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.tencent.mm -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tencent.mm -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.tencent.mm -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tencent.mm -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.tencent.mm -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.tencent.mm
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4736
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
703KB
MD57036e1ebc564380e72414a4ae742d14d
SHA11d80809e4be3279fd77fccd1edd86051ff1934ae
SHA25699b48ae8cb05ff46f23cd94d3196e042b37f4949af438eafdebc3aa71459a85f
SHA512ef793ef449fb8cc773a83efa67d6396d88f7f73b68d7a3c32578f6040e91417b56c26f0ccc3c712b4af4f41fa955b6518463a5e86027192e5ae1db67e8d985dd
-
Filesize
703KB
MD5ed494f937b47e81787bcaf9f782cd8d9
SHA1080db0c22e4505cac4fac99d68ebd3d5276d43a3
SHA25686c34d8dd3a96745efc8129df4615c7c8b6f4e82cb11d13615e77ddfe92d143e
SHA5122a783a3c4fb4cb0051010c3d1eda1461d2be38c871b0ec6b0112548f6f7790908244d3a20b2946afc1a6734af8a564ece7d57f6f4edcd1a1a81ad46ea5dff188
-
Filesize
1.5MB
MD58abe1776ebc0143c41a8a6d094595815
SHA11365273a8f69eaa5d3d2af99783b94c8fa2a2622
SHA256475d7bf5bc9c08e50677bd53df71fd79d50561bc48a7d5446ca61174fed101ad
SHA512741528a836f230418ffb4c36df9a3a9b142b0ad1689f0acc3821d3f34b4a4264ba50bb5b73706f13595622d538d259124bec1d7ff5c62ef601a91a5f11702fb7
-
Filesize
3KB
MD5ca7749a575bba85b088c7ddddb4e2aeb
SHA1e578d4c2dd2d4748f11f8d08977bd4a94a3a06d9
SHA256b8dd6b3b1133f6d8c141c00bdcf355de8f2673444b41fcb259116f317ce67055
SHA512c8a19755a03c967ed63d75e6d8f0170ece54c7b72131206fb6f5734587d9b626afe70f54cd65f36a9ba8943b481b3e768379ec3b43e6b0bd53fe08592dbbd070
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5b24a4179d9867ee73b1dd526bf5af419
SHA1a5397f90fcafcebed4f08a1678b2d5f81c2acc03
SHA256f358a28f5e95fddbe44e5c7a420460e562d023634e99b43cbbbb867b4eb2cf42
SHA512e5200d9a4e40e14a1870025bb0cc0428a0badd5b1e431a74a1a464e1ecef65d35b1584ea55eeb08d2dfa0e45bf1b7e29371462cb03515d126b53e94302110c20
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5576c65d1f2d2ceeee39e9d2ddb95ac9e
SHA168c3288b5c6689f1542fa4114071264d38a6271c
SHA256589cacdd96f59fcf8633beb0985e1fe6f78de2fd2d5d20aaacd7cf86e1a0d0ac
SHA512cfa30f47ca3a0572aa0c77c9e1b5ac72804847f419b6407af2d0fac5c04cb5dbc3539a3aa966ecda320cdba194f12449a97db476fc2da16c0fd6d4d446b571b1
-
Filesize
108KB
MD5d159c8af875c8e13deb96a4d91c9ff18
SHA12ef1a9afcea50cb6f141b1f5d2fca92c6201b026
SHA256e6a628a8d75a199b7bd2b02ea65ad2791df454f6f3d907ca180e0c44cf470ed9
SHA51200849aa218f5ba4f21095609557ff8866d5291f57f134367fd3a6c89d8c9515abcd1784d5072ca89e4130251d9f21d6c0a9053e795316c90b245a8b36960ba6c
-
Filesize
173KB
MD5ea32891af8b3f92a09950984567bfc77
SHA1a2374b5c5334d73a63dceedb4c08052a3adae6df
SHA2566b5fb69932cafb7c8552d3c7a71063dd5e5ea30fd29709f7bff6986123ae14a9
SHA512b8da8c8d348f2582e0afab1fda0e7ccc1452175080571c45458540118df5e422498b18262b39409c66829babc0b338ab941bde6981d0bdbcd028e93628ee9c1a