Analysis
-
max time kernel
149s -
max time network
158s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
08/04/2025, 22:19
General
-
Target
725c2cb1c28c05dc82dc93927b936d3a835324367576b3cf18af467c5752301b.apk
-
Size
2.9MB
-
MD5
75d6c41d247cbe0e9bfa784e07ff700f
-
SHA1
2dfaf4266166f177280a2ad2c462c0bae195ba8d
-
SHA256
725c2cb1c28c05dc82dc93927b936d3a835324367576b3cf18af467c5752301b
-
SHA512
f261756135693acec2383e4f7b8e36fa2524b2a70c007706a4c6a898f4fb8d8f7858987820ee5e00eacbab642c88ad38a802984f82e1e3ee9cdc2d94aa677939
-
SSDEEP
49152:IqHzAFvKkY3rT1Ky+5IWfYBoezOVY6ANw6aES6pFU2t7j3MGlo17+hZ0INvBYabV:5Uv3GhR+5eoCOrjWS6N7j8g3T5Yq1API
Malware Config
Extracted
ermac
http://176.123.169.239
Extracted
hook
http://176.123.169.239
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Hook family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v16
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
3System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
703KB
MD548f060bb8032843adf14387ccfd28dd3
SHA1e209254102b6b380a1cddbd6f3818f9374882f72
SHA2563ebda64f76fcbc5b76009550e9119bb80b34bbdcf9b937a3d26c38843bc52f69
SHA512f9e579ba2a097f0ea6567c7a93cad18640f4c59ee79c7401c861994f4130f56048feb7899ccaab7f893f109a9ebf5d10f0ae4f5ac3838a42a57099b9784fcc00
-
Filesize
703KB
MD5b28a519a74a079bff0617f1ac5e9893a
SHA138f5ce5ea1b55a27b3fb561e2e64bba5df020085
SHA256993f18d9a821c513bd87c17c55ccbf8842cc3cc0615b760ebd8d6a02e9e3da42
SHA512b626e5561710b0bac0b774b6b68bdddf9635428672a67214eed42b40d1bc465d6b8342bc40a14c39f594f4dcff61361800c5d2bebcde03adb78aff38a59c6dbf
-
Filesize
3KB
MD5db751c1b42bcd4b33fda972b3ada2b5b
SHA15bcbf4b0ef5f22494aef547605382ecd70172ef2
SHA256263a83cbf6032ff551911b7cd9705de3176cce58ccf654e6724a844d3d9de326
SHA51229f91c681e5954bc2b59b7ddf0ad93a0279ecda6b7a17eca9d7a1e07133e0b1b6b1165f7366c9bd0323074cd0bbced83d0044a09b6a6e0e6f52b00ec670cac1d
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50f368295a2a081ced76d8bd429eb4d53
SHA1f37186fbc604e2dbd2f9183edc724f774e1fcd86
SHA256c6ce1d3a5efa4363cf32fb4c5fb754f832875e9d75d64bcb3354dc4937d10b0e
SHA5121ad9ecb5924a9c3b56adff6eaaef665c26b3817f5a51881238e39d5ae7f5474888996d2e975667f8fb76325d2a7037c0298ef1157823dc6f1305eecd24ff5dc9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD571b90c2d58b0f71a6a0b64becba6bb3f
SHA186bfc22e7d32cca1c14719403bac52b7f16d3ebd
SHA25665611995e8c8ef7c67fcc45aa979fbb83f57eae5be469b65ad80595f7c3a12f6
SHA5127e145e01c1439e1dab9c21a25fdf2e265fe472288fdf7b5cff27f0134ea51080eb3fd3c237d0835343c63716c8568ebcd21b15bce3b86ab7bb338dbab3de33a6
-
Filesize
108KB
MD515b86fd76db69809836de17e1c3df92c
SHA1e17780d23b3342750318399dfd8f93e9a7786a67
SHA25678a683ec4298925ad735752746cd03cf0bf1c5cf906a3911b85b3dac0e0dbdc2
SHA512fe38ba2fb53b4f180f8c6b955929da4325d38e1294f7276f2a004ceee90704568573dc7bda01603489c15c7ebaa615c47d0508558844f2c95f9b89373d0471f4
-
Filesize
173KB
MD54b2188033c88e0893a06ebbae269f0b6
SHA180280a4a1dc8c219c8f29470c26919331401f54d
SHA256b73dc82da2185911ca9a36c09d47324780ee3c5a6c5ddd8cb36fc4bf5b66b75d
SHA5125da674faff3fbc30721e9ac5b936b3efd409b203ef53c2ec0d92b67ba4b6ae4374674b516e187fb1fdded9446964d2585c06376a0a794045b6546b8402606979
-
Filesize
1.5MB
MD52ed7fe2320b0bbc4d75b899f28c6c918
SHA1fda0b763ac36fc014568d3ee29e424343b75278b
SHA2560d448c1c4915a9ab1b94c1d8757ec4ee09a5973bf4e2e1661a9ec65e673b7b38
SHA51243a9c85e3f127caea4a448ab08342cb041e29e5087473dd733e59285a75bf518f7358c5ea1f4c910ce75d637df321968979c1c8e69a2417b1278191d38f2279b