Analysis
-
max time kernel
147s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19/03/2025, 22:00
General
-
Target
00bf4f784cc5100cc2377d7645e71542607918d3399329a4b634d8eeea0fe1d3.apk
-
Size
1.2MB
-
MD5
0ee2c9a8d23c128f8b728d9dca61b353
-
SHA1
8519a49f458cbf6ddf2c6cd1c877d42e2f832c93
-
SHA256
00bf4f784cc5100cc2377d7645e71542607918d3399329a4b634d8eeea0fe1d3
-
SHA512
8e4cab6252fd5f2193769caec6e3f1df502d54f12812f999a53593453d4d1548948c568900b3fc532923b98ecf4360ec29f27b52fe0ffac35057c2e1e2a36d14
-
SSDEEP
24576:Ar5AcJOBLtAUqvblXWkQb7027QFv12GQAq6DVungSseWKU/kfKc:A91sLNqRX5QH020BoNIDYgSgfYX
Malware Config
Extracted
ermac
http://194.26.135.189
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 12 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 11 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
m36uk1.nhhxx.nn4zuj71⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5930848d8b36b9bdda307a0b651e0f6d4
SHA109fd7fc06733276012deee9d5527f579fc41c1c9
SHA256c09106228c280448690dc91430d5827e0c2f0838660e127bd1f25ec8fc323e29
SHA51209ad1ac9f8a20872935fecb523a8d744dd1deac638caea0976bc1bd3fe576fcf54ee36ede59180c3930c6668aac8cdab059fd91636c4e581ee5d4be87add14ba
-
Filesize
126KB
MD560fc19b58d8b451b41f9bdcbd1f0ca67
SHA189b895677e11e96f97801ff498a6be8f302c71b7
SHA25610c205629a03266ea7b28c73151551e19a9aeeefa8079dfe78781e370ec90c77
SHA512c7556f00df13a906f3b4941b9205586bebccd74cbd77818f302ba7f2e87607ed8ff5c04b61eb5589ec98d79e3f2f196cb7140000873ee7db59d18ca0f246f1d8
-
Filesize
30KB
MD573b5595e570f7a22f92de49e466d3c40
SHA1b24ad99990ef61c2eee73b9ceb60edbba65cd621
SHA2563fe3ce420c34ea08f30f9a844d9bed71a45899f24d960a8d6bdf57f0ca13c39e
SHA512f8b2c6764ba0f777a28d3a0d5402d1bea4f3926bd8f88a61326848c201e74a5c7af84072029f915c2e474cc98ebc7b2567c4c3477fe98e27c74cfa141e161b1f
-
Filesize
1KB
MD506a867a8f319bebf08c01fe618672a73
SHA15d5bace760d92bc1c048bcd2cacfcd30e310e0c6
SHA256fe25a21e8d232b3ba461a6fdfa6dda70b61ac5cecec200be9b4b0ec53408a49b
SHA5120700395a92b4e862ac557a9c7deee98f27d5af262a42d87c48314927edc2dc1d2c0603b2248101cb5e67ab0c2328dd277a23986fd5bb086000c686cb837863ee
-
Filesize
3KB
MD5236814b3bbe6c9a512fc7526256d799f
SHA15e9b1288c56678581f52e70cc2975ee05040e450
SHA256d23813e047b8d088b935872fc55ccbdf0f2cd2676d3ae6568236119c8b2b71ae
SHA5120e631664050a635bffcb02fb9c7993f572b3d7a9862f01ef7adf005df9da62efac789299028e07d333aa27196ab2e59ffd993f3083e18e8b559aef9267c4fc31
-
Filesize
541KB
MD5a0a0f176952e3d88c73ea49b8eb82dab
SHA17402683535b9365fe4b449f02f3f257f88c11006
SHA256baf2de6faff8af304f869a25f5d9af7e8583fd7f6f90a744805c65818b7b2a18
SHA512bdda0f180ecd132cafa28baf81be6100edeeb76b70daa42cce8f250c3a3e387c3c49ee2e22da96be6130560eb2599c9ab9215ea3d7419bd3bbb8dbe9ce696109