Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
159s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
24/03/2025, 22:04
General
-
Target
d32bb0cdfdbb1cfcabfa5bbab3a17dd5e31ae8c3f5fa509756e82503e07cfcc5.apk
-
Size
1.2MB
-
MD5
f0176cf2581a501fe99c39bbe0be128e
-
SHA1
b5af9121fc0220e65913625a4a42bdf877ca5adb
-
SHA256
d32bb0cdfdbb1cfcabfa5bbab3a17dd5e31ae8c3f5fa509756e82503e07cfcc5
-
SHA512
d2820455fc0539c677b4705e8f156ab712bb820d957564ea41854c4db061e4b02f63040271898b4159d5b4a5d92eeb6f3ec1b16ae53512c655434095140e6dbb
-
SSDEEP
24576:yYg/BsyImy7qXxRWIYEj60O7LNunLtsl8iAL3Cm:7g/HjyMxRWpEjzyMhRym
Malware Config
Extracted
ermac
http://aumvzxzebra.xyz
http://auvzmashinadx.xyz
http://auglogvnja.xyz
Extracted
hook
http://aumvzxzebra.xyz
http://auvzmashinadx.xyz
http://auglogvnja.xyz
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.yelonuzavixanexi.dibi1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
2System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5e706f2e42ce34d603d07354611cc2331
SHA137cd6d445d8b652f90fe9ea4703535b6203877a5
SHA256ce9b6d959f169589f814cab6a2366b43ccc1cbf7a2dbfb1a47097071b5cf1813
SHA512b1d0d57b24ec61ed498ddb5f136793310cc514266d8972d68ae14dc70360ff0f8dceb73c7e6d550ed437617693f052cc56696ef239c11427433563eec9c57aee
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD54b2ed947f9dc41ceef697571a1988a56
SHA1e379932a1d7bacb47c3a77b43e2b3ea5bde931a5
SHA256315be5e2527615c52a763776462785ef7a7829a027a289881c9047704ef24a5d
SHA512ad9ddc7c09a60ce994e4b69d159adccfe527527c456f2f48f17e5c586b34ab7d491067746ed79886c21bad42127bd926e5428dd1e63d90b374fc7fe1ca7e489f
-
Filesize
108KB
MD5ea0662d326bbd759a072520608fa21d0
SHA15090a89325129580c05e872609eeea2dcaba18d7
SHA2566523d6608ecf1c6c669fa8bd005b30f24d93f98c8894c9f5e4f98783260a1097
SHA51261831cbc12eae62864442b895a94b0d0ee9767b12b462688ff177485798831f7794d2de01af66eceaf8fe5503b35ec7e3bf0f97cba65c0efc0f3fc4a32eb9334
-
Filesize
173KB
MD52ea32044a43dd958186b62e6c8ac6ecc
SHA1b26ccd144305a493fb84472eb32ee8c1fb9916ec
SHA256143c8b462bb3c8d666b311fd0582cb62e499d412f64905b091ce34031e14715a
SHA5124f16d34003c5016de51d7377a690bee7f749238db9dc436cbaec83a6bf42c582271baa15e04d2cd8ab9dc0ea2813bf5a3aba4033cdf8b70b5f16aa4a7aef3530
-
Filesize
1.5MB
MD588a96841b7e220f3cdf309edbf1518c2
SHA1533fc02969f2b367a05b686fceb4ad345e3c2753
SHA25664e0e1c95d238309991f0c473e9d830b5843cb2ecd7386d4b9882738fc22f3bf
SHA5129c9bc50168a365ac78425fb411e8e06587c14f9c18eb1f8aa11bf992b798345559c02592e42666e6a3faa0ce60d116b80aeb77a9c3563048a5d18533a23320aa