Analysis
-
max time kernel
148s -
max time network
147s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
21/03/2025, 22:25
General
-
Target
cfd7495d787e33920fda854b8fd008e05e428fdcdaab76575ed932189b95e13e.apk
-
Size
4.8MB
-
MD5
97a74ac186fd3327a7a5c141430e756b
-
SHA1
4c50de2ad383c5d1530330221cc420c5b6485f17
-
SHA256
cfd7495d787e33920fda854b8fd008e05e428fdcdaab76575ed932189b95e13e
-
SHA512
2d362df7c37fc13ffcb40e21992629bdee80b55010f071819e4cc0e616deeb3f3945a4deb5d5f9c5e54aed9fab4eecff0e4c07e6c4613bf2e6a31a042e9ddea5
-
SSDEEP
98304:sqt56Zw/boLHyn0DmjFOOWLJGLIxbEBow9Jov62l8f/NvP6U9GBta:3t0qziyhj2nxGowPovr8flvP6Nta
Malware Config
Extracted
ermac
http://5.42.67.88
Extracted
hook
http://5.42.67.88
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5f5793fe7eff01c737010b5629219b260
SHA16f7f34366d09673f8b218fb39a5a6749ca373b32
SHA2569ddb548ef6a77f0caa5ee3645c532f12e5308c73c0ef3a653b841c8fbf6f03ab
SHA51225d8a4b88ca10bb53c8e3ff09d254d70e66da267cf2fef24a7c9b9c8b3297fb3314e87b53bf64c6b928a4bbd3490565bd309925858416d697aace34cffee6ceb
-
Filesize
2.6MB
MD523b46ec4bda8739c78f7247989653662
SHA1396fa499110c77823022deb12c4f8ef4dda2df09
SHA2560ddc0d87b6901432d4a96beaf0d15e8c69a158b1ad57b14268c424f2d959a445
SHA512818a7636bd9beaca54c7a94fe49e200d2d9cf301ba187525285f29b4bbeeeb210c9dd98fb707d00f7a37e9315a3870cb86adc604a6c6f4baf3d460fb462729e9
-
Filesize
5KB
MD5ced54e9f59481dfbc1beb17b4f7dc4c0
SHA15ff2c79daa96b96432e954391847ed8ff4176650
SHA2564a400cbbc3a3fd8b356954629511afe02f633d1a8b3a212d4f47ded8e74d58ae
SHA51280a7ff36f5f4c1aade6d29783c86f295ca9eca2501910613456230dc58b7dff1c6fa4fc1ed3838e8325dd21a9521c01b94491e230c9445cba0a15f3f14c44bdf
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5b355aef585b98dd4813005aac33ae05a
SHA1f2a0b33fee7f9fe429c52e81adf92fd4021f3a25
SHA2568e69a7683cdf39496f095f49648dd9fefe87ea36399c222233f4071b5e25dabc
SHA51245ebed4271c1c690f9d4de97c1bcd2864e69186fb78c1b4b37e681abe119af4299eb7c1d5b37e33bce9872c427fe44aee84c5a6df75392cf4a2a0bae1f2367e3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5756f55571280d03d66dae0255bdc05b9
SHA1bc70a52abd4a30bf0f0957958fdbdeb5b83889c4
SHA2561673c7831223a8c6ed026f7422254b27f8afb219b70c35fe252b82dd7531bcc8
SHA51285db2efbae9039ef1c46675aeceb9d91ca26b7c19f9d14770d7688f9890499764b359f6e89709abe648c47e43c11b7add82b0f446ca7b326d7899b71f4b32272
-
Filesize
108KB
MD5e91f7b51bb0196a58f53ef32d93fdd3d
SHA1b7188c3829b310fa2911061d4643cac4593f3266
SHA256ab0645d6eb2862e936674cb35ac86e566c5b72d4d27448fb0a0b29c2d4919a7c
SHA51266e27352eb15d52671b2daf9bd7f40d92a51468cd9c9a0e844a7df33bfc19a1ebbc1fc7a2c4158afa00525c6dcf01a78ced9225c22c0ba6918915181ef0aa192
-
Filesize
173KB
MD524508575438605267977e65cbe2a48a0
SHA183812530fd78bb55a9720be6981a837aa43ee4f0
SHA256b26883550204c4d68d8ef1f1cd7c5d0d96b7df96859c14ed88a131b543f254f9
SHA5124ee20cb9048839f5ef8e9a5d0a9ea2ad28bd923b9e98c94e29f8571d097da72357858eb4a2fe76f5623aa28d979902f98a5669bf5e263fc21a79c435b60bd5a5
-
Filesize
6.7MB
MD579ba52989185b39a50e4d81244a7032b
SHA170c8a24bc94dea95799a8f516326cc0d2b577d55
SHA2566849c00c63eb73b1e1db8ddf0209bbce1bff3adbe640049d49afc0a256609df7
SHA512b0e83ff14f37f8b71941e05e4364e33e61f51b56d527f6c3871bafc978cefff966f2c67db16a765be1998cc76d6c51a6095bcd2eee676503144ae23421f50b4c