ermac | 9c4b5a4d8766b7afd264f9b0c5a50dfa9572516b3b09cab43846137c251a752a

Resubmissions

05/03/2026, 19:15

260305-xyamaaax3z

05/03/2026, 19:10

260305-xvr26aax2v10

03/03/2026, 14:05

260303-rd357sat3x10

Sharing

Copy URL Twitter E-mail

General

Target
9c4b5a4d8766b7afd264f9b0c5a50dfa9572516b3b09cab43846137c251a752a.bin.zip
Size 57.0MB
Sample260303-rd357sat3x
SHA256 9c4b5a4d8766b7afd264f9b0c5a50dfa9572516b3b09cab43846137c251a752a
MD5 90ec48b6a8978836a6525f1db43b48af
SHA1 65d9107e6e813a3616f299c2306c94c3d4c166c4
SHA512 2076a726ee8c7073a3eaf8f87cff1671ad7b5bc1c78912cb6971f287b3adab846079691b46ea3eceb27defe96b3c9448f316cdbc9cdc2f16fdc3cfd862d4c74a
SSDEEP 1572864:cKqOQ4Yx8Re0V5WHWpiE050M0f08050M0f0XU6K54Dlwo//efOr4+BMF6JlE:cKqOQ4YeRe0V5WHWpiZuRcBuRcXO54SN
TLSH
T10BD71283F79AE813D8F3C735867683669A265C544B53E3972945B13C0DBBAC08B85FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

spynote

188.212.101.133:8000
1.tcp.sa.ngrok.io:26109
192.9.175.87:4443

Extracted

Family

spynote

188.212.101.133:8000
1.tcp.sa.ngrok.io:26109

Extracted

Family

spynote

for-nails.gl.at.ply.gg:33645
0.tcp.eu.ngrok.io:15517
45.33.120.118:8173
prev-labels.gl.at.ply.gg:7691
102.217.238.0:5214
navigation-zones.gl.at.ply.gg:17761

Extracted

Family

mobileorder

blackbeekey.com
k7k7.co

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)

Targets

- Target
  AlSalah.apk
- Size 113KB
- SHA256 1d22924bbe5dce7696e18d880482b63ce19ca0746f8671aaec865cce143f6e6f
- MD5 e7584031896cb9485d487c355ba5e545
- SHA1 ce01950e9b1f6db2653f47728b8dfcf261cc81f4
- SHA512 35948e56d177547e74a9a39535e430f401ad74457009cd7d693baefed94a2b3e010133e92da06ce908b62b48cd9e19c8b5bad872bd66e6ad60b46c5139d7f2ea
- SSDEEP 3072:serWeAQjVS+CpqIN0OOB7Fhy+Pdi6dEw71:seKJICptN5QM+PD2w71
- TLSH
  T141B30291DB884CD8D1A99C309263EA09BD7DF121062FA37C8D8C57F4E6835DA0E5A74F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  Android Defender.apk
- Size 1.5MB
- SHA256 cca27d0f8955bf653cb70b41e7438b107bfd075374d92ca8208e319331240c83
- MD5 48f6dca2ae182285b8ded7a326090f96
- SHA1 e73f4a43b7d9a6eaf77c35b1f95a05140ac9412f
- SHA512 4796a87faa4928b7bd01d2a4cfc92711d60597b6db5a50222fd9ab844a3f5d05acd93e7212f7f4a300869d5bc078061520d935ee088939da595f9ea24ed0c42d
- SSDEEP 24576:vkBDaYo8/sG612v8mtHYNVQSaBrtGrlCwcUplxRB9I9CxJCJMmg:sBL/sF2vzBYzQ/HPUlfB9wCxY+L
- TLSH
  T120751291A3ED4529F5F39B3999310456E839BCC56A21D29E0215B85C0EBBF80CF71FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery impact privilege_escalation
- Checks if the Android device is rooted.
  defense_evasion
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Tries to add a device administrator.
  privilege_escalation impact
behavioral4 behavioral5
- Target
  App2Card 2.8.2.APK
- Size 2.9MB
- SHA256 0ed1ce633b6cfe411f251af1ce290f5ed0845845b0c96e671f8cddfe97969f47
- MD5 afd12639e21c1884d33737aba0bc43ee
- SHA1 6311ec7b8f44806f389674ec88d9f668616b83e8
- SHA512 861ebb0824c0da56bcb05f1cc5d593a081d0c0a50fccce0d3b8aff569167c4be46faf0cffe6a9f77cf10ecdd54dbb6a5c9e7212586194897ff071a97904d29d4
- SSDEEP 49152:ADTAtW5l1eWXX+qjXBoygkMwy+V+fopVfUC3ElcEWbzuYd1L5AJX0/b:ED5T/JjXaUmUdUCdD
- TLSH
  T173E5335E5BBF911DDCB5DAB80BAACF480B1806E14B5C62BB5CD99B041CE0CE1A305EF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion persistence
- Checks if the Android device is rooted.
  defense_evasion
behavioral6 behavioral7 behavioral8
- Target
  Application Petya screen locker.exe
- Size 391KB
- SHA256 d606959edab4be250b820aa6d2e7da7fa0111c6ffc993bfcad28d3ab9350db7c
- MD5 00fc590b5b8d6de7131557ae08a093fa
- SHA1 fe5de4d3ed4b19927936e67f726ba60b673f4adf
- SHA512 1c25b18688ce02955f777d431644423743b4a0fff5b4785e075a7ba46fd58ea53a9d0a9084719424aa46252fea50c96dd32e3844f0c908a0306433d4a859c586
- SSDEEP 6144:hFbPEfyZheSVqQSZhG7dBgLXypvknbwTQivW/Rf8f+TLAEfyZheSVqQSZhG7dB4O:soRktie/R0fgNe/R0fRRktIQ
- TLSH
  T1868407C399FB6E07E1E546B15DE1D36207717C0DD9A2E64D18C1AC42EEBA4E1280BDF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence trojan
- UAC bypass
  defense_evasion trojan
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral10 behavioral9
- Target
  BaDoink.apk
- Size 309KB
- SHA256 4d3de2103f740345aa2041691fde0878d7d32e9e4985adf6b030d2e679560118
- MD5 67bde6039310b4bb9ccd9fcf2a721a45
- SHA1 9617b0a883060e01b26b9d36c5b919fb83943a8d
- SHA512 9552f40ef744632c929efed8e0c5fe1492574f22e38323d280cb050034ddce335abeb21603e340ba1022716846026ba68469f4ef05dac53758f78a2b3a150752
- SSDEEP 6144:MWq/9kwR2UyYng86goLWBvtRatTCcNgvTldW0PBRmX/UCqBqyAN/RW:E/9NkY16gEA6DEw0PWvUtQNo
- TLSH
  T1D5642361A9633919DFB3E373849131B39E06BD2DF6E4BC26D257BC1A84198392E1CC09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence collection credential_access impact
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral11 behavioral12 behavioral13
- Target
  Barsik.apk
- Size 251KB
- SHA256 8b19f070988204f44da34567b4b81aa9869ca399827c92ea5a6397cee250c4f7
- MD5 43adcff1ff93576d6ac391cf520957e7
- SHA1 d86de92dea11d6abbac1fe225bfe8fe7968e59c2
- SHA512 0e291a932809ec9554d7242f9717bd854c2e3166f7673446d4979f33ab7e699a235387fe2eda33cc43ac14517c7f1d1dff580b62453902b2957960a1389698f6
- SSDEEP 6144:hOxjgYIcRbqGQGhFLE5RDRWPwbUcgPVKW64ydOK:hqUDc84Ffwb/gPVKW641K
- TLSH
  T1E04412DBC2E81DF8E16E13F60433A344F4A10581D80AEAD65B35E7EC694C9B1A1FDE52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence evasion impact
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral14 behavioral15 behavioral16
- Target
  Battery Doctor.apk
- Size 517KB
- SHA256 26fbec09b4196260dca8ef94d2605dba8d4db6bb869a170c83ad99bdcb1eb70d
- MD5 df4595ee727706d2cfdb7c9a1fe9e079
- SHA1 e0180cc81fe303574a40cf64b680528628dcc0cd
- SHA512 6ef28a9335cdb82069ad8608f019ae7b83b257ae48726545fe7e5758094d922a1bc3b43026df6feeedc8038ca499a40249b2702dd610d730773c237d17be02f9
- SSDEEP 6144:NzAE/u4soffPaXw9jQSsWwQlrMJ7a4FFOKLtUMQVDDFzR7RhWrYr24:NzAHW3aQpdwQ+LDOKLtUnJDFzDhWMrJ
- TLSH
  T111B41287A3DA5974F6B71F39AABB10485C263DD06901CADD2251B44D0C77F008BADFAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence collection credential_access impact
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral17 behavioral18 behavioral19
- Target
  BotWhatsAppAssistant.apk
- Size 197KB
- SHA256 d77d9242bbf4594277b96ed9af5f2fa721b82c578d0e0c640f42928ec8002257
- MD5 a14e9bfc6dfdfa6fca36a7aefe7590d1
- SHA1 e7781b298b4c41d858d0cbbc7c1f41e23362cac8
- SHA512 e4368a8710ceb36a375a5b06c5c2ad218b22e47966560d9980be22b370d4ac7ba0d929199b0c9f37cc255e3627330d6c641c76f9d5f2021e80a7b2e407abae88
- SSDEEP 3072:9ao9gotnv3rKWXwZs+gmiPYUg4/XVJ2bqfAwXuO1Mz6k7mp1wEpi61eu:9ao9gotTRusNk4PQVv70dp7eu
- TLSH
  T1861412665D8634E4DEBB07B4DF7AB0D46A44EC53A06EB61D3024B83D1D70B8B235F8A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker defense_evasion discovery persistence
- Checks if the Android device is rooted.
  defense_evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about active data network
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral20 behavioral21 behavioral22
- Target
  Bowling Time (1).apk
- Size 829KB
- SHA256 f49410d96e93822e44dfa1a45b55e250abca233a43f4afb0237a1a0f76b62e67
- MD5 d4fa864eedcf47fb7119e6b5317a4ac8
- SHA1 72adcf43e5f945ca9f72064b81dc0062007f0fbf
- SHA512 a06b8621bcc29912058d253afe2a33755f2c8d9a36c2ead3e17c6a22a6892a4a5a210cff7337928cdeb81fb03cab9ed96d2db035f8f72cba33a9d8a6d229581e
- SSDEEP 24576:pdXyP/6n/qKDRfAvryuPoQvjjOp7NIigwM67R:pdXyP/iq4ojyuPoQjip7NwMR
- TLSH
  T164051267BB89F866E8518C75DA1180617332F4892A16D25F30CA7F3DBD1FE412C56B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Queries the mobile country code (MCC)
  discovery
behavioral23
- Target
  sqlite.db
- Size 13KB
- SHA256 13bbced329c83cb3b1e4abf6508dba00f1a65a87485596b52061ba19658606d3
- MD5 ecc970647a187a710df723f5dbd567a0
- SHA1 745ba38fffad114117599c36e249fdeb57a5acd6
- SHA512 219ff47a471a88d4bc6b906c6a04854d6c8847bbbbb1477e8a563992624a2538da0af5d7d4dbe1dc3e9f85959a06df0cfb795075cf075cb821c34a975f064ff0
- SSDEEP 384:T+vSkI9n0i5fTRMHZfYr3PQmt0mUGtr+brm:T+vsF0iJRM5fYr3PL4+
- TLSH
  T11E52DFBCBFFAD159D13A4A7DA3BCB528AC4D94203F45E75C2F0001894D86AE8970CD76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25 behavioral26
- Target
  Bowling Time.apk
- Size 829KB
- SHA256 f49410d96e93822e44dfa1a45b55e250abca233a43f4afb0237a1a0f76b62e67
- MD5 d4fa864eedcf47fb7119e6b5317a4ac8
- SHA1 72adcf43e5f945ca9f72064b81dc0062007f0fbf
- SHA512 a06b8621bcc29912058d253afe2a33755f2c8d9a36c2ead3e17c6a22a6892a4a5a210cff7337928cdeb81fb03cab9ed96d2db035f8f72cba33a9d8a6d229581e
- SSDEEP 24576:pdXyP/6n/qKDRfAvryuPoQvjjOp7NIigwM67R:pdXyP/iq4ojyuPoQjip7NwMR
- TLSH
  T164051267BB89F866E8518C75DA1180617332F4892A16D25F30CA7F3DBD1FE412C56B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Queries the mobile country code (MCC)
  discovery
behavioral27
- Target
  sqlite.db
- Size 13KB
- SHA256 13bbced329c83cb3b1e4abf6508dba00f1a65a87485596b52061ba19658606d3
- MD5 ecc970647a187a710df723f5dbd567a0
- SHA1 745ba38fffad114117599c36e249fdeb57a5acd6
- SHA512 219ff47a471a88d4bc6b906c6a04854d6c8847bbbbb1477e8a563992624a2538da0af5d7d4dbe1dc3e9f85959a06df0cfb795075cf075cb821c34a975f064ff0
- SSDEEP 384:T+vSkI9n0i5fTRMHZfYr3PQmt0mUGtr+brm:T+vsF0iJRM5fYr3PL4+
- TLSH
  T11E52DFBCBFFAD159D13A4A7DA3BCB528AC4D94203F45E75C2F0001894D86AE8970CD76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29 behavioral30
- Target
  CMAccessIndex.apk
- Size 197KB
- SHA256 4cbcb8f8eafb3d475362bdb7eddc4cb255c89926e03813ff0efa7652bb696e97
- MD5 9a031f2f5022fae13849b566a1b89579
- SHA1 67cec2e8784219774e8500064113caa535d3a41a
- SHA512 208b232fa33f2fa571ad6a603712b439939ac1488c0fa49d7b88c00f33196d72038720e70a627a483451ac0dcaa356656aacd211c90911c14cf4b0f30a7a8275
- SSDEEP 3072:F9LFKqd4wgBeCSdP5Gn4Kv2ITTaIPH244qqefReGZ1QWeU/32U+PB36fqDZBEciE:Ffd4XwNdhOO4NSefrsWN3yB36GUc7ec
- TLSH
  T1D11413D2C6F57941F17B1233733AA0C67ACAC488ECDA5241F492FC6F46B51168EE2C86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

banker defense_evasion discovery persistence
- Checks if the Android device is rooted.
  defense_evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about active data network
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral31 behavioral32