Analysis
-
max time kernel
148s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 22:25
General
-
Target
cfd7495d787e33920fda854b8fd008e05e428fdcdaab76575ed932189b95e13e.apk
-
Size
4.8MB
-
MD5
97a74ac186fd3327a7a5c141430e756b
-
SHA1
4c50de2ad383c5d1530330221cc420c5b6485f17
-
SHA256
cfd7495d787e33920fda854b8fd008e05e428fdcdaab76575ed932189b95e13e
-
SHA512
2d362df7c37fc13ffcb40e21992629bdee80b55010f071819e4cc0e616deeb3f3945a4deb5d5f9c5e54aed9fab4eecff0e4c07e6c4613bf2e6a31a042e9ddea5
-
SSDEEP
98304:sqt56Zw/boLHyn0DmjFOOWLJGLIxbEBow9Jov62l8f/NvP6U9GBta:3t0qziyhj2nxGowPovr8flvP6Nta
Malware Config
Extracted
ermac
http://5.42.67.88
Extracted
hook
http://5.42.67.88
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5f5793fe7eff01c737010b5629219b260
SHA16f7f34366d09673f8b218fb39a5a6749ca373b32
SHA2569ddb548ef6a77f0caa5ee3645c532f12e5308c73c0ef3a653b841c8fbf6f03ab
SHA51225d8a4b88ca10bb53c8e3ff09d254d70e66da267cf2fef24a7c9b9c8b3297fb3314e87b53bf64c6b928a4bbd3490565bd309925858416d697aace34cffee6ceb
-
Filesize
2.6MB
MD523b46ec4bda8739c78f7247989653662
SHA1396fa499110c77823022deb12c4f8ef4dda2df09
SHA2560ddc0d87b6901432d4a96beaf0d15e8c69a158b1ad57b14268c424f2d959a445
SHA512818a7636bd9beaca54c7a94fe49e200d2d9cf301ba187525285f29b4bbeeeb210c9dd98fb707d00f7a37e9315a3870cb86adc604a6c6f4baf3d460fb462729e9
-
Filesize
6.7MB
MD579ba52989185b39a50e4d81244a7032b
SHA170c8a24bc94dea95799a8f516326cc0d2b577d55
SHA2566849c00c63eb73b1e1db8ddf0209bbce1bff3adbe640049d49afc0a256609df7
SHA512b0e83ff14f37f8b71941e05e4364e33e61f51b56d527f6c3871bafc978cefff966f2c67db16a765be1998cc76d6c51a6095bcd2eee676503144ae23421f50b4c
-
Filesize
5KB
MD53c6628de8924a3928bd5397e8d6c9892
SHA1eaee56e4335c9c2f439815f40f120d28859d9c27
SHA256f3e96e787228682a541b65b0cb62cf86b7fcee35a75d2331103285cc6f2bd682
SHA51244cd6b5def7e08cdbd36418f6ad1c6dc42cec9d205567cc65a9e6d1c69bfb52b332e693f0ae2083f38177fc15e7b58c902033e1bb9a54d2fb3b43d0ba48b32f6
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5a9cc5639cd9e448f3c6928a7dab43379
SHA1e523c7958c36f5fd4f1b93c9daf19f9113d2a126
SHA256be58c0ff7b6bff7b9ad7e278c0756203dc1cde0e6193dd996f8b9df0700f93e8
SHA512cc0116579c880aa15caf98d79d1f57887c569adb61c8b68e1b25a7127e42213315d179ded79c3863bc4b078b0d9c88209848e52af12e71962e5caf354a75af2b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5ded4112a5621c0fa4ccc029f8dfe46a1
SHA13652a4e2c71be557bf9ddba8efb2478351ed480a
SHA256d80523c32dc756db48db090962d5cf541c66d78a7cc8b5e4cedee4e6885a6827
SHA51203f3a260d858d84908415a42e1d6331641b6c1b6e7e206a1b14dc9310a57628a9ac6c9f51b66de9a7dd9cc8ea642fd241b234a183b831d16547fe17034d957bf
-
Filesize
108KB
MD59c12379ac77dd50698fb8de58f470c4d
SHA1bb7ba6b45e949d004186c8df3a17de80c0202323
SHA2566904e56f11c4e15ef4767bbc0d41d889386d1e79c51fe43ca6c879d40e33ffcc
SHA512d9502604a7f9c74cb89474c0949b468f85b728408753d1bc828448a631ff367c263ad81cc48603ea65ea167276d65411e875490e89507c025a5aded9cfa41d2b
-
Filesize
173KB
MD518c314cde7a239972f1288d0db5b83da
SHA19b25451ca3bee055910779b62297df60d5006060
SHA256a27f3869a66d646282ba54369ef47eb25addacbf2b7a80228b90cdd53c1cee15
SHA512fbdeb2ac7d8f21cfe22e4e75a5f375203a6972086d60776d5640882e96c08be965af55accf07686f2e0aa021623c3a84b9e5f54391e3bfac290bd907af915d4f