Overview

overview

10

Static

static

6

00bf4f784c...d3.apk

android-9-x86

10

00bf4f784c...d3.apk

android-10-x64

10

00bf4f784c...d3.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    19/03/2025, 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    00bf4f784cc5100cc2377d7645e71542607918d3399329a4b634d8eeea0fe1d3.apk

  • Size

    1.2MB

  • MD5

    0ee2c9a8d23c128f8b728d9dca61b353

  • SHA1

    8519a49f458cbf6ddf2c6cd1c877d42e2f832c93

  • SHA256

    00bf4f784cc5100cc2377d7645e71542607918d3399329a4b634d8eeea0fe1d3

  • SHA512

    8e4cab6252fd5f2193769caec6e3f1df502d54f12812f999a53593453d4d1548948c568900b3fc532923b98ecf4360ec29f27b52fe0ffac35057c2e1e2a36d14

  • SSDEEP

    24576:Ar5AcJOBLtAUqvblXWkQb7027QFv12GQAq6DVungSseWKU/kfKc:A91sLNqRX5QH020BoNIDYgSgfYX

Score
10/10
ermacbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

ermac

C2

http://194.26.135.189

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 1 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 12 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 11 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • m36uk1.nhhxx.nn4zuj7
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4774

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/0.pobfs
    Filesize

    134KB

    MD5

    930848d8b36b9bdda307a0b651e0f6d4

    SHA1

    09fd7fc06733276012deee9d5527f579fc41c1c9

    SHA256

    c09106228c280448690dc91430d5827e0c2f0838660e127bd1f25ec8fc323e29

    SHA512

    09ad1ac9f8a20872935fecb523a8d744dd1deac638caea0976bc1bd3fe576fcf54ee36ede59180c3930c6668aac8cdab059fd91636c4e581ee5d4be87add14ba

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/1.pobfs
    Filesize

    126KB

    MD5

    60fc19b58d8b451b41f9bdcbd1f0ca67

    SHA1

    89b895677e11e96f97801ff498a6be8f302c71b7

    SHA256

    10c205629a03266ea7b28c73151551e19a9aeeefa8079dfe78781e370ec90c77

    SHA512

    c7556f00df13a906f3b4941b9205586bebccd74cbd77818f302ba7f2e87607ed8ff5c04b61eb5589ec98d79e3f2f196cb7140000873ee7db59d18ca0f246f1d8

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/2.pobfs
    Filesize

    30KB

    MD5

    73b5595e570f7a22f92de49e466d3c40

    SHA1

    b24ad99990ef61c2eee73b9ceb60edbba65cd621

    SHA256

    3fe3ce420c34ea08f30f9a844d9bed71a45899f24d960a8d6bdf57f0ca13c39e

    SHA512

    f8b2c6764ba0f777a28d3a0d5402d1bea4f3926bd8f88a61326848c201e74a5c7af84072029f915c2e474cc98ebc7b2567c4c3477fe98e27c74cfa141e161b1f

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/3.pobfs
    Filesize

    1KB

    MD5

    06a867a8f319bebf08c01fe618672a73

    SHA1

    5d5bace760d92bc1c048bcd2cacfcd30e310e0c6

    SHA256

    fe25a21e8d232b3ba461a6fdfa6dda70b61ac5cecec200be9b4b0ec53408a49b

    SHA512

    0700395a92b4e862ac557a9c7deee98f27d5af262a42d87c48314927edc2dc1d2c0603b2248101cb5e67ab0c2328dd277a23986fd5bb086000c686cb837863ee

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/4.pobfs
    Filesize

    3KB

    MD5

    236814b3bbe6c9a512fc7526256d799f

    SHA1

    5e9b1288c56678581f52e70cc2975ee05040e450

    SHA256

    d23813e047b8d088b935872fc55ccbdf0f2cd2676d3ae6568236119c8b2b71ae

    SHA512

    0e631664050a635bffcb02fb9c7993f572b3d7a9862f01ef7adf005df9da62efac789299028e07d333aa27196ab2e59ffd993f3083e18e8b559aef9267c4fc31

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/5.pobfs
    Filesize

    541KB

    MD5

    a0a0f176952e3d88c73ea49b8eb82dab

    SHA1

    7402683535b9365fe4b449f02f3f257f88c11006

    SHA256

    baf2de6faff8af304f869a25f5d9af7e8583fd7f6f90a744805c65818b7b2a18

    SHA512

    bdda0f180ecd132cafa28baf81be6100edeeb76b70daa42cce8f250c3a3e387c3c49ee2e22da96be6130560eb2599c9ab9215ea3d7419bd3bbb8dbe9ce696109

    Download Submit