General
-
Target
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92.bin
-
Size
1.6MB
-
Sample
250319-1ygx5symz4
-
MD5
850afa828e6ffd3b88e2dc19ee687a54
-
SHA1
6534debaf122e033d9527ae7de89b31b767b3d68
-
SHA256
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92
-
SHA512
4984535cbd77f950bf40d7495319ada7bc83d270875289d5b38ce74b50e85873223a28b94cd37268d01241a2a41210f1653c2b2ebf5f6aaf17bce9ddd0abdc24
-
SSDEEP
49152:zEuRi5mLBgveKeUCtMfW4ajw/H+46pRH4U0NMgSL:bREYBtKeLeCjw/H+4QRH4f2
Behavioral task
behavioral1
Sample
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92.apk
Resource
android-x64-arm64-20240910-en
Malware Config
Extracted
ermac
http://154.90.62.12
Targets
-
-
Target
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92.bin
-
Size
1.6MB
-
MD5
850afa828e6ffd3b88e2dc19ee687a54
-
SHA1
6534debaf122e033d9527ae7de89b31b767b3d68
-
SHA256
7e6efaca9c9ee33b5d795b84c0013a0023f43c59d14f802e5faee2ef182a8b92
-
SHA512
4984535cbd77f950bf40d7495319ada7bc83d270875289d5b38ce74b50e85873223a28b94cd37268d01241a2a41210f1653c2b2ebf5f6aaf17bce9ddd0abdc24
-
SSDEEP
49152:zEuRi5mLBgveKeUCtMfW4ajw/H+46pRH4U0NMgSL:bREYBtKeLeCjw/H+4QRH4f2
-
Ermac family
-
Ermac2 payload
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2