ermac | 15cbd3bb713080b652522e82ce3f73b0b8dff403180b5c581616c41a47a77a46

Analysis

max time kernel
149s
max time network
156s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
01/04/2025, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15cbd3bb713080b652522e82ce3f73b0b8dff403180b5c581616c41a47a77a46.apk
Size

2.3MB
MD5

9a4654476dace477d64335a25636eda5
SHA1

9c35dacfe1f1030d4e834d5f8f8e08e1e96968c6
SHA256

15cbd3bb713080b652522e82ce3f73b0b8dff403180b5c581616c41a47a77a46
SHA512

8c61ec965e27f9f6a033f1638d1311583e2a1bfce58a45dd5487241c056871460a8d35334c95585bb5250f1ab188131b1f4b4abe327d93213dd352a46a2c88ea
SSDEEP

49152:E0o1Tm0qHy7UA8s7NUFqK9HMee5RCFpOnCh4riDa:EN1TmcD8ENUFJseeHUcjim

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://aunuredvac.xyz

http://aumvzxzebra.xyz

http://auvzmashinadx.xyz

AES_key

Extracted

Family

hook

http://aunuredvac.xyz

http://aumvzxzebra.xyz

http://auvzmashinadx.xyz

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4763-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cunegahazuhocalu.migogatu/app_DynamicOptDex/ki.json	4763	com.cunegahazuhocalu.migogatu

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cunegahazuhocalu.migogatu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cunegahazuhocalu.migogatu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cunegahazuhocalu.migogatu

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cunegahazuhocalu.migogatu

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cunegahazuhocalu.migogatu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cunegahazuhocalu.migogatu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cunegahazuhocalu.migogatu

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cunegahazuhocalu.migogatu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cunegahazuhocalu.migogatu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cunegahazuhocalu.migogatu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cunegahazuhocalu.migogatu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cunegahazuhocalu.migogatu

com.cunegahazuhocalu.migogatu
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4763

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.cunegahazuhocalu.migogatu/app_DynamicOptDex/ki.json

Filesize
689KB

MD5
ef35efd29a7e01f6725b063062ff4881

SHA1
917a5eb591b8959629d0d013d09d6637588d8eff

SHA256
1a33526d4ccc72d854441e2cbe31119816cc87962306b336dec4f9967fa05e55

SHA512
0ce1a26839000c2608af57f6a42cc267281a07e6f49123e3d4862a50947e513ae4eb6c10ef34b4a7ac6da0b6cc61bd1baad4a77e748643e3f8df71328984ccd3

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/app_DynamicOptDex/ki.json

Filesize
689KB

MD5
99bb9e7bfd2373c6916282de5521ee72

SHA1
7486ea9fc30444c1077af8d59fe8691811bb41fa

SHA256
7154bcae1ffdfd485a7432413161ad1a8b9e05903fc56e76f23784b3ff05b79f

SHA512
c2f4950afe9df64b14f26c19c8e9fc0ba72116fa6e38e396c9702364194b2b26cff59fee8bee2475e76c5f33c2d0225dc69ef4e23a61e2a638d111dcc72baa1b

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/app_DynamicOptDex/ki.json

Filesize
1.5MB

MD5
fef3d9f75651d3cb802b3c7d1f9ad724

SHA1
bc5b2ea7a94313a9c4f98bbe3f786fc2950b65b1

SHA256
693c9951e16f2b505ab0937cd5ccaaf91bcbe40e4ac3215fab2a227581d8c510

SHA512
f8c9c7ec346f9342008353d5e98d99be49629949d9c6ab98e104da07a61553ffa0a2d484cfbb51d71be49b1035e9bf6193f470fdd0621f8a8fea94b7bf47917f

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/app_DynamicOptDex/oat/ki.json.cur.prof

Filesize
2KB

MD5
9c6093a4f5f7090170708e0673974d73

SHA1
93be3a42458f761a33ae7289f67a57fe5ec214b2

SHA256
2f98fb01b9e023f6cedac5430c2ed66d2e4ef9b43a96e4fffe5b75a46d119935

SHA512
e63a2a307bb1a1d0fa7e93999ec7985c35ff317c73dabe6515baa7bd818c0e516ba9ac66e9413e673ce0c36135bb7b5180af82861362840f19e91b297cdb6a9a

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
401d8bc85a06a31c0da2033022b66aa5

SHA1
de0c9f4e5527002f75c5b7dab512934bad169a47

SHA256
e7bc56743eca1383c5a5b0f3234f2e731583d04be1d6c637938bbd02cc52fe0e

SHA512
cb76549806450bada91313bdd78cb9dd9bc0736810f9f35f05eab516693d58e40952e04ab77b2491e806e6d992e30994ed4563bf26e4a70887d91aec194c1ed4

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d0e66ed3f989218a313ea86e96546e11

SHA1
e62f5ea75c6789f354b69ad5881c063b920f7418

SHA256
91ea4bbe67e3167c4cfed4b6e4f53aef320d1b1273ffa58a79cf397b09285420

SHA512
617c606818d51e932fab0c7393930f48f206ca0078627f2b64beeac44f42c05e6eb752fc95d45c2e53de2f84fc501aaf06b7250e089d0eabf7ddd718b41709c6

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
f596742dba167c69ecdfa94b33299a67

SHA1
0827afceac5c9c76156a12eb5ff24989519c468c

SHA256
bd81f607f3b654e3acc487aa6161d487ea51a3be8bee49203405ab5a789853b8

SHA512
f3985445053d289fb1cd397dc8a41aef67fbf2ef5d5591ab439f01010b5c0b576583c29eaff3065b4f88ce791487416c57f44591f40d63fbfe8480c661f08af5

Download Submit
/data/user/0/com.cunegahazuhocalu.migogatu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
fa0ea75bbe742cc2a32ebab75c549741

SHA1
820d03e3412217ccf6d1d331e5d3f3e83a8de1a4

SHA256
5af61c9fe69ef91e6ab5ec70f0561fc57f6d0410a44246c98d403c45bc986bc1

SHA512
dd4233db8051d2b09990f119c6ca0e6dc5273577bd6b234d8c5ba8099cc35dc9ddcd35039fee93ad9d9fac8c81f46709a94d370c4ceeda52db9a7d51024ebc38

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads