ermac | c86c012726be23ffb4e6e36d01a99c6729ea779380b973b7d9ee93110cfe518f

Analysis

max time kernel
21s
max time network
151s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
19/03/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c86c012726be23ffb4e6e36d01a99c6729ea779380b973b7d9ee93110cfe518f.apk
Size

1.7MB
MD5

3f6ce2be5a6110d2b43d807fda7c6801
SHA1

ab84d36182b83041a2d094283a013c771b79bb48
SHA256

c86c012726be23ffb4e6e36d01a99c6729ea779380b973b7d9ee93110cfe518f
SHA512

5cab4471e10d0f6cf041714cae01e38002c0176b46ae53b330efbc9ccdd970baa564cf0fd2109114d11f90a26f3c5147ba0165df261b99a439d16781e0f07b99
SSDEEP

49152:cUuRy5mLpgveKei8NSda/uHwhmvxJ5OuXnqPQ9hgSJ:QR0YptKei8oQufvnXqP2P

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://154.90.62.12

AES_key

Extracted

Family

hook

http://154.90.62.12

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5114-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.mm/[email protected]	5114	com.tencent.mm
/data/user/0/com.tencent.mm/[email protected]	5114	com.tencent.mm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.tencent.mm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.mm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tencent.mm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tencent.mm

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5114

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/.McAfee/libMcAfeev1.so

Filesize
326KB

MD5
e8d7b4161f4217144e99142583da1a4a

SHA1
1fb6dce537cc5d533f3129f0dc1dbafb14beaa8b

SHA256
6c0dffb878e6728bc62f39b2d0cd31c97e9e8ba420dbf91940201b44f9881cad

SHA512
736b0ab82ae4e43284532b41ed29aa06624662d2f0fdadaf9c8e3934128fc8f83d6035a345875d6153bbba254c81fee0c1b251814f204a34d3b0deffd4d90df9

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
66f52f39d7f3a49dede806ad53ed042e

SHA1
3aafcd4639cef2e8c31fbcbde14f9a32f7e6a656

SHA256
a0deaa4ea17783f350a78a3c54a6f480885b8b4eb2009071c4fc2fdd15aa769a

SHA512
849216f35b4bf0c45c09755e22f92be07f5d4079681c02f24f7318e6065f61f52581d3aa00d1f14ed38f803c0adf3cbfc1cc0a54d1a92b0e154bd38e6a25018c

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6b766fc162b426b5e266cc64d64de5ec

SHA1
3a9794a1be97d7a8cb5d3c0df545f2e6e4bfc40f

SHA256
7168544eef03bad09e77bfb4c09a147f872ca0b88b85d2c9f3ef64e3e5e4dfdc

SHA512
7d336a925f014da508e173187e00bd4314ccc511be99952d1e2fc22767577e5f72a575b19b27cec486ee0be3d8be73beb94d5c4e47a82ecaaa9b0157f23c82fe

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
ca8b9e209eaa5b27203c1f0b846bbcb3

SHA1
1fdad875ed61303a655ff43b160fcb5603b338a7

SHA256
3af6a5b5e894519236c53bbda1256602368579c55849fba34b2bf91698b6e423

SHA512
b1b88b7bd8e2eaaa1ea0ecf79526d77b1ba8f9dbb73fd3d32c8b669d126a7b52eb27c9ce3de5ad71ad1f4c11c45094b976a2defacc0c530249034e0e40d901ab

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
185KB

MD5
89c8fa39f29ff02a25caf8fb99e4cdad

SHA1
dde13ce708d678d9fe3b3eaf6d88292516dc020f

SHA256
ffc3483ba73be9626fbfa5a68ba9b699738aa3436c4b80590c458f6ba4dc0b5b

SHA512
c92b59ec56dd06cb30eb0142025abc532908f2980f250cb54e29035ac82e47af672f0d692dcc987124231cb5c5559bc232882323f3c5cf7a6a3e80a3ed95145b

Download Submit
/data/data/com.tencent.mm/oat/x86_64/[email protected]

Filesize
157B

MD5
4233e4c6f565c79ce3b95a038132aab0

SHA1
cddafaf685170b4ccb5cc8e9893cca5c3e32864d

SHA256
ebd7685b091ff92858404f368018f94f3d1762f7a5f81cf12e0c4f8e3c766a70

SHA512
356420cc3227a8d29d870aa49d72e2785143de6beb432ff5e6ce9086883bad0ea653f90384f901ffb2146f61ea08e0bf39622bdd8d7884be8ef36adce198927f

Download Submit
/data/user/0/com.tencent.mm/[email protected]

Filesize
2.0MB

MD5
40cb56a4d76414296a84bfed60b6c127

SHA1
6b2a5132dd77022708b2b9959737f8377a93a465

SHA256
9364ddf46fe1bf90cebac61bc7cbba8707de8158ce444a8fb43220dd50d0699d

SHA512
ea743dbf8e188e17589a443c49bbd07d5ebef8edd8a02b40f32bdd9fdbfcdcc63e298f6c4cbd27cfcd9033fc9382b30b0c5fec3e60e400f2dca34a40f5815a02

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads